ci: 🎡 Update when e2e tests run (#3320)

* chore: 🤖 update desktop client changelog and version

* fix: 🐛 update PR number

* docs: ✏️ updated log

* fix: 🐛 revert cli version change

.copywrite.hcl

@@ -1,19 +1,21 @@
 schema_version = 1
 
 project {
-  license        = "MPL-2.0"
-  copyright_year = 2020
+  license        = "BUSL-1.1"
+  copyright_year = 2021
 
   # (OPTIONAL) A list of globs that should not have copyright/license headers.
   # Supports doublestar glob patterns for more flexibility in defining which
   # files or folders should be ignored
   header_ignore = [
-    ".github/**",
     ".husky/**",
     "**/node_modules/**",
     "**/dist/**",
     "**/coverage/**",
+    "**/pnpm-lock.yaml",
+    "**/pnpm-workspace.yaml",
     "ui/desktop/electron-app/out/**",
     "ui/desktop/electron-app/ember-dist/**",
+    "e2e-tests/api-client/**"
   ]
 }

.github/ISSUE_TEMPLATE/bug_report.md

@@ -11,21 +11,57 @@ assignees: ''
 
 For questions, the best place to get answers is on our [discussion forum](https://discuss.hashicorp.com/c/boundary), as they will get more visibility from experienced users than the issue tracker.
 
-Please note: We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue in Boundary, please responsibly disclose by contacting us at security@hashicorp.com. Our PGP key is available at [our security page](https://www.hashicorp.com/security/).
+Please note: We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue in Boundary, please responsibly disclose this by contacting us at security@hashicorp.com. Our PGP key is available on [our security page](https://www.hashicorp.com/security/).
+
+Logging is available on Boundary Desktop Client version >= 2.1.0
+
+Logs are found at:
+
+Linux: ~/.config/Boundary/logs/desktop-client.log
+MacOS: ~/Library/Logs/Boundary/desktop-client.log
+Windows: $env:USERPROFILE\AppData\Roaming\Boundary\logs\desktop-client.log
+
+If requests are taking longer than expected, please change the logging level to DEBUG. This will log the cache daemon request times as well.
 
 -->
 
-**Describe the bug**
-A clear and concise description of what the bug is.
+## :bug: Bug Report
 
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Run `boundary authenticate  ...`
-2. Run `boundary connect ...`
-3. See error
+### **Description**
 
-**Expected behavior**
-A clear and concise description of what you expected to happen.
+_A clear and concise description of the bug._
 
-**Additional context**
-Add any other context about the problem here.
+### **Steps to Reproduce**
+
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See the error
+
+## **Expected behavior**
+
+_A clear description of what you expected to happen._
+
+## **Actual behavior**
+
+_A clear description of what actually happened._
+
+## **Screenshots (if applicable)**
+
+_Add screenshots or screen recordings to help explain the issue._
+
+## **Environment**
+
+- **OS and Version:** (e.g., Windows 10 (22H2), macOS (14.7.2))
+- **Architecture:** (e.g., arm64, x86_64)
+- **Browser/Version:** (if applicable)
+- **Desktop Client Version:** (if applicable)
+- **Controller/worker versions:** (if applicable)
+
+## **Logs & Console Output (if applicable)**
+
+_Paste any relevant error logs or browser console output here._
+
+## **Additional Context**
+
+_Any other details that might be relevant._

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: BUSL-1.1
 
 contact_links:
   - name: Ask a question

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+      interval: "monthly"

.github/labeler.yml

@@ -1,23 +1,30 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: BUSL-1.1
 
 addons:
-  - addons/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/**/*"
 
 api-addon:
-  - addons/api/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/api/**/*"
 
 auth-addon:
-  - addons/auth/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/auth/**/*"
 
 styles-addon:
-  - addons/rose/**/*
+  - changed-files:
+    - any-glob-to-any-file: "addons/rose/**/*"
 
 ui:
-  - ui/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/**/*"
 
 admin:
-  - ui/admin/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/admin/**/*"
 
 desktop:
-  - ui/desktop/**/*
+  - changed-files:
+    - any-glob-to-any-file: "ui/desktop/**/*"

.github/pull_request_template.md

@@ -1,29 +1,33 @@
-:tickets: [Jira ticket](https://hashicorp.atlassian.net/browse/JIRA_TICKET_NUMBER)
-
-## Description
-
+# Description
 <!-- Add a brief description of changes here -->
 
-## Screenshots (if appropriate):
+<!-- Uncomment line below to manually add link to JIRA ticket -->
+<!-- :tickets: [Jira ticket](https://hashicorp.atlassian.net/browse/JIRA_TICKET_NUMBER) -->
+
+## Screenshots (if appropriate)
 
 ## How to Test
-
 <!-- Add steps to test this change. Include any other necessary relevant links -->
 
-<!--
-Replace PATH_TO_FEATURE with Vercel link
--->
-
-:technologist: [Admin preview](PATH_TO_FEATURE)
-
-:desktop_computer: [Desktop preview](PATH_TO_FEATURE)
-
-## Checklist:
+## Checklist
 <!-- strikethrough the checklist item that is not relevant to your change -->
 
+<!-- If you are merging a long lived branch, major feature, or UI altering changes,
+please add the a11y-tests label. Other cases, like a dependency change or
+translation update likely does not need an a11y audit -->
+
 - [ ] I have added before and after screenshots for UI changes
 - [ ] I have added JSON response output for API changes
 - [ ] I have added steps to reproduce and test for bug fixes in the description
 - [ ] I have commented on my code, particularly in hard-to-understand areas
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] I have added `a11y-tests` label to run a11y audit tests if needed
+
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

.github/scripts/merge.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: BUSL-1.1
+
 
 set -euo pipefail
 
@@ -27,7 +28,6 @@ echo "Trying to merge the latest oss commit - ${latest_oss_commit} from oss/${BR
 if ! errors=$(git merge -m "Merge Boundary UI OSS branch '${BRANCH}' at commit ${latest_oss_commit}" "${latest_oss_commit}"); then
   # Here we can try to auto resolve conflicts
   # This logic will vary from project to project. The below is just an example.
-  # We'll try to resolve package.json and yarn.lock conflicts by taking the OSS changes
   conflicts=$(git diff --name-only --diff-filter=U)
   printf "Found conflicts:\n${conflicts}\n"
   # Resolve package.json conflicts by taking oss
@@ -36,11 +36,12 @@ if ! errors=$(git merge -m "Merge Boundary UI OSS branch '${BRANCH}' at commit $
     git checkout --theirs package.json
     git add package.json
   fi
-  # Resolve yarn.lock conflicts by taking oss
-  if echo "$conflicts" | grep -q yarn.lock; then
-    echo "Checking out oss yarn.lock..."
-    git checkout --theirs yarn.lock
-    git add yarn.lock
+  # Resolve pnpm-lock.yaml conflicts by re-running pnpm install:
+  # https://pnpm.io/git#merge-conflicts
+  if echo "$conflicts" | grep -q pnpm-lock.yaml; then
+    echo "Re-running pnpm install to fix conflicts by regenerating pnpm-lock.yaml..."
+    pnpm install
+    git add pnpm-lock.yaml
   fi
 
   # If we can commit all the changes without conflict, we have resolved everything automatically
@@ -91,4 +92,4 @@ gh pr create \
   -b "${BASE_BRANCH/oss\//} upstream merge of (${SHA::7})"
 gh pr merge --auto --merge
 
-# This PR will be need to be approved manually
+# This PR will be need to be approved manually

.github/workflows/a11y-tests.yaml

@@ -0,0 +1,56 @@
+name: A11y Tests
+
+on:
+  pull_request:
+    types: [labeled, opened, synchronize, reopened]
+  workflow_dispatch:
+
+jobs:
+
+  a11y-test:
+    name: Run A11y Tests
+    if: contains(github.event.pull_request.labels.*.name, 'a11y-tests')
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    timeout-minutes: 40
+    steps:
+      - uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        with:
+          install-dependencies: true
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+          run_install: false
+      - run: pnpm install
+      - name: Run a11y tests
+        env:
+          # this will generate the test reports but causes tests to pass even when there a11y failures
+          ENABLE_A11Y_MIDDLEWARE_REPORTER: true
+        run: pnpm test-a11y
+      - name: Consolidate ember a11y reports
+        run: |
+          mkdir ember-a11y-reports
+          jq -s 'map(.[])' ./ui/admin/ember-a11y-report/*.json > ember-a11y-reports/admin.json
+          jq -s 'map(.[])' ./ui/desktop/ember-a11y-report/*.json > ember-a11y-reports/desktop.json
+      - name: Output ember a11y test report summary (admin)
+        run: 'cat ember-a11y-reports/admin.json | jq "map({moduleName,testName,routes,urls,violations: .violations | map({id, nodes: .nodes | map({failureSummary, targets: .[] | .[]? | .relatedNodes? | .[]? | .target? })}) })"'
+      - name: Output ember a11y test report summary (desktop)
+        run: 'cat ember-a11y-reports/desktop.json | jq "map({moduleName,testName,routes,urls,violations: .violations | map({id, nodes: .nodes | map({failureSummary, targets: .[] | .[]? | .relatedNodes? | .[]? | .target? })}) })"'
+      - name: Upload ember a11y reports
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ember-a11y-reports
+          path: ./ember-a11y-reports
+      - name: Report a11y test results status
+        if: always()
+        # fail CI when the combined array length of admin and desktop a11y reports is not 0
+        run: |
+          EMBER_A11Y_FAILURE_COUNT=$(jq -s 'map(.[]) | length' ember-a11y-reports/admin.json ember-a11y-reports/desktop.json)
+          echo "$EMBER_A11Y_FAILURE_COUNT ember-a11y test failures"
+          if [ "$EMBER_A11Y_FAILURE_COUNT" != '0' ]; then
+            exit 1
+          fi

.github/workflows/build-admin-ui.yaml

@@ -3,95 +3,92 @@ on:
   push:
     branches:
       - main
+      - "release/**"
+  workflow_dispatch:
 
 jobs:
   dependencies:
     name: Install dependencies
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
         with:
-          node-version: 16
-      - run: yarn install
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+          run_install: false
+      - run: pnpm install --frozen-lockfile
   build-admin-ui-oss:
     name: Build Admin UI OSS
     needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
-        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 16
-      - run: yarn run build:ui:admin:oss
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:oss
       - name: Upload artifact admin-ui
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: admin-ui
           path: ./ui/admin/dist/
       - name: Upload artifact OSS admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: admin-ui-oss
           path: ./ui/admin/dist/
   build-admin-ui-enterprise:
     name: Build Admin UI Enterprise
     needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
-        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 16
-      - run: yarn run build:ui:admin:enterprise
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:enterprise
       - name: Upload artifact enterprise admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: admin-ui-ent
           path: ./ui/admin/dist/
   build-admin-ui-hcp:
     name: Build Admin UI HCP
     needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
-        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Build
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 16
-      - run: yarn run build:ui:admin:hcp
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:hcp
       - name: Upload artifact HCP admin UI
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: admin-ui-hcp
           path: ./ui/admin/dist/

.github/workflows/codeql-analysis.yml

@@ -17,7 +17,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
 
     strategy:
       fail-fast: false
@@ -27,18 +27,23 @@ jobs:
         language: ['javascript']
         # Learn more...
         # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
-    
+
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+    - name: Set up Node
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # codeql-bundle-v2.14.6
+      uses: github/codeql-action/init@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
+        # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
@@ -54,4 +59,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # codeql-bundle-v2.14.6
+      uses: github/codeql-action/analyze@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7

.github/workflows/copyright-validate.yaml

@@ -0,0 +1,19 @@
+name: Add Copyright Headers
+on: pull_request
+jobs:
+  copywrite:
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        # Ref and repository aren't normally needed, this is a workaround for a bug in auto commit
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+      - uses: hashicorp/setup-copywrite@32638da2d4e81d56a0764aa1547882fc4d209636 # v1.1.3
+      - name: Add missing Copyright Headers
+        run: copywrite headers
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        with:
+          commit_message: Add missing copyright headers

.github/workflows/jira.yml

@@ -1,88 +0,0 @@
-on:
-  issues:
-    types: [opened, closed, deleted, reopened]
-  pull_request_target:
-    types: [opened, closed, reopened]
-  issue_comment: # Also triggers when commenting on a PR from the conversation view
-    types: [created]
-  workflow_dispatch:
-
-name: Jira Sync
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    name: Jira sync
-    steps:
-    - name: Check if community user
-      if: github.event.action == 'opened'
-      id: boundary-team-role
-      run: |
-        TEAM=boundary
-        ROLE="$(gh api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n ${ROLE} ]]; then
-          echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
-        else
-          echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
-        fi
-        echo "role=${ROLE}" >> $GITHUB_OUTPUT
-      env:
-        GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
-
-    - name: Login
-      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-
-    - name: Set ticket type
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      id: set-ticket-type
-      run: |
-        if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "type=PR" >> $GITHUB_OUTPUT
-        else
-          echo "type=ISS" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Create ticket
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
-      with:
-        project: ICU
-        issuetype: "GH Issue"
-        summary: "${{ github.event.repository.name }} [${{ steps.set-ticket-type.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
-        description: "${{ github.event.issue.body || github.event.pull_request.body }}\n\n_Created from GitHub Action for ${{ github.event.issue.html_url || github.event.pull_request.html_url }}, from ${{ github.actor }}_"
-        # customfield_10089 is Issue Link custom field
-        # customfield_10091 is team custom field
-        extraFields: '{"customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
-
-    - name: Search
-      if: github.event.action != 'opened'
-      id: search
-      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
-      with:
-        # cf[10089] is Issue Link custom field
-        jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
-
-    - name: Sync comment
-      if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: atlassian/gajira-comment@164913891625fe50e9836957902e0bf7d9ef99a8 # v3.0.1
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
-
-    - name: Close ticket
-      if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        transition: Done
-
-    - name: Reopen ticket
-      if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        transition: "To Do"

.github/workflows/labeler.yml

@@ -4,8 +4,8 @@ on:
 
 jobs:
   triage:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/monorepo-validate.yaml

@@ -4,71 +4,71 @@ jobs:
 
   dependencies:
     name: Install dependencies
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
         with:
-          node-version: 16
-      - run: yarn install
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+          run_install: false
+      - run: pnpm install --frozen-lockfile
 
   compliance:
     name: License Compliance
     needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
         with:
-          node-version: 16
-      - run: yarn run compliance:licenses
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run compliance:licenses
 
   lint:
     name: Lint
     needs: [dependencies, compliance]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
         with:
-          node-version: 16
-      - run: yarn lint
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm lint
 
   test:
     name: Test
     needs: [lint]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
-        id: node-modules-cache
+      - uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
         with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+          install-dependencies: true
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 16
-      - run: yarn test
+          node-version: 24
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          run_install: false
+          cache: true
+          cache_dependency_path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm test

.github/workflows/oss-ent-merge-trigger.yml

@@ -10,7 +10,7 @@ jobs:
   trigger-oss-merge:
     # Run this only on merge events in OSS repo
     if: ${{ github.event.pull_request.merged && github.repository == 'hashicorp/boundary-ui' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
       - name: Trigger Merge
         env:

.github/workflows/oss-merge.yml

@@ -4,10 +4,10 @@ on:
     types: [ oss-merge ]
 jobs:
   oss-merge:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       - run: |

.github/workflows/test-e2e-admin-ui.yaml

@@ -0,0 +1,340 @@
+name: Test E2E Admin UI
+
+on:
+  pull_request:
+    types: [labeled, opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      boundary-enterprise-branch:
+        description: 'Branch of boundary-enterprise to test against (default to main)'
+        required: true
+        default: 'main'
+        type: string
+      boundary-branch:
+        description: 'Branch of boundary to test against (default to main)'
+        required: true
+        default: 'main'
+        type: string
+
+jobs:
+  setup:
+    name: setup matrix
+    # don't need to run e2e tests on ce -> ent merges since tests were already
+    # run in the ce branch, and there are currently no code differences between
+    # the two repos
+    if: github.actor != 'hc-github-team-secure-boundary'
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Set matrix
+        id: set-matrix
+        run: |
+          BOUNDARY_BRANCH="${{ github.event.inputs.boundary-branch || 'main' }}"
+          ENT_BRANCH="${{ github.event.inputs.boundary-enterprise-branch || 'main' }}"
+
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            matrix=$(jq -cn --arg branch "$BOUNDARY_BRANCH" '{
+              browser: ["chromium", "firefox", "webkit"],
+              include: [{
+                boundary_edition: "community",
+                github_repo: "hashicorp/boundary",
+                folder_name: "boundary",
+                boundary_edition_short: "oss",
+                enos_scenario: "e2e_ui_docker",
+                test_command: "admin:ce:docker",
+                boundary_branch: $branch
+              }]
+            }')
+          else
+            matrix=$(jq -cn --arg branch "$ENT_BRANCH" '{
+              browser: ["chromium", "firefox", "webkit"],
+              include: [{
+                boundary_edition: "enterprise",
+                github_repo: "hashicorp/boundary-enterprise",
+                folder_name: "boundary-enterprise",
+                boundary_edition_short: "ent",
+                enos_scenario: "e2e_ui_docker_ent",
+                test_command: "admin:ent:docker",
+                boundary_branch: $branch
+              }]
+            }')
+          fi
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+
+  test:
+    name: test
+    needs: setup
+    runs-on: ${{ fromJSON(vars.RUNNER_UBUNTU_22) }}
+    strategy:
+      matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
+      fail-fast: false
+    env:
+      ENOS_VAR_e2e_debug_no_run: true
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          cache: true
+          cache_dependency_path: |
+            pnpm-lock.yaml
+            ui/desktop/electron-app/pnpm-lock.yaml
+          run_install: false
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e
+
+      - name: Set up Enos
+        uses: hashicorp/action-setup-enos@6ec106c8f809fe645162d73bea565c65f3269907
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Vault CLI
+        run: |
+          wget https://releases.hashicorp.com/vault/1.17.6/vault_1.17.6_linux_amd64.zip -O /tmp/vault.zip
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            unzip -o -q /tmp/vault.zip -d /usr/local/bin
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            unzip -o -q /tmp/vault.zip -d "$HOME/bin"
+          fi
+
+      - name: GPG setup
+        run: |
+          # Create a GPG key
+          export KEY_PW=boundary
+          gpg --generate-key --batch <<eoGpgConf
+              %echo Started!
+              Key-Type: RSA
+              Key-Length: default
+              Subkey-Type: RSA
+              Name-Real: boundary
+              Name-Comment: default
+              Name-Email: default
+              Expire-Date: 0
+              Passphrase: $KEY_PW
+              %commit
+              %echo Done.
+          eoGpgConf
+
+          # Enable gpg-preset-passphrase so that key passwords can be saved
+          echo "allow-preset-passphrase" >> ~/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye &>/dev/null
+
+          # Get information about the created keys
+          export lines=$(gpg --list-secret-keys --with-colons --with-keygrip)
+          export KEY_ID=""
+          while read -r line
+          do
+            # Save the first key id to be used later
+            if [[ $line =~ "fpr"* ]]; then
+              if [[ $KEY_ID == "" ]]; then
+                KEY_ID="$(echo "$line" | sed -r 's/fpr|://g')"
+              fi
+            fi
+
+            # Cache the passphrases for the keys so passwords do not need to be entered
+            if [[ $line =~ "grp"* ]]; then
+              export KEYGRIP_ID="$(echo "$line" | sed -r 's/grp|://g')"
+              /usr/lib/gnupg/gpg-preset-passphrase --preset -P $KEY_PW $KEYGRIP_ID
+            fi
+          done <<< $lines
+
+          # Trust the key
+          touch /tmp/test.txt
+          gpg -a --encrypt -r $KEY_ID --trust-model always --batch --yes /tmp/test.txt
+          echo "trusted-key $KEY_ID" >> ~/.gnupg/gpg.conf
+
+          # Initialize the password store
+          sudo apt-get update
+          sudo apt-get install -y pass
+          pass init $KEY_ID &>/dev/null
+
+      - name: Checkout ${{ matrix.folder_name }} repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ matrix.github_repo }}
+          path: support/src/${{ matrix.folder_name }}
+          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          ref: ${{ matrix.boundary_branch }}
+
+      - name: GH fix for localhost resolution
+        run: |
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            cat /etc/hosts && echo "-----------"
+            sudo sed -i 's/::1 *localhost ip6-localhost ip6-loopback/::1 ip6 -localhost ip6-loopback/g' /etc/hosts
+            cat /etc/hosts
+            ssh -V
+          fi
+
+      - name: Set git config
+        run: |
+          git config --global url."https://oauth2:${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com".insteadOf "https://github.com"
+
+      - name: Install Dependencies and Browsers
+        run: |
+          # Block Playwright from doing anything during the pnpm install
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 pnpm install --frozen-lockfile
+
+          cd e2e-tests
+
+          # Install browsers and dependencies based on the repository
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            pnpm playwright install --with-deps
+
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            # Use raw apt-get to install system libraries without npx
+            sudo apt-get install -y \
+              libnss3 \
+              libnspr4 \
+              libatk1.0-0 \
+              libatk-bridge2.0-0 \
+              libcups2 \
+              libdrm2 \
+              libdbus-1-3 \
+              libxcb1 \
+              libxkbcommon0 \
+              libx11-6 \
+              libxcomposite1 \
+              libxdamage1 \
+              libxext6 \
+              libxfixes3 \
+              libxrandr2 \
+              libgbm1 \
+              libpango-1.0-0 \
+              libcairo2 \
+              libasound2 \
+              libgtk-4-1 \
+              libgraphene-1.0-0 \
+              libevent-2.1-7 \
+              libopus0 \
+              libgstreamer-plugins-base1.0-0 \
+              libgstreamer-plugins-good1.0-0 \
+              libgstreamer-gl1.0-0 \
+              libgstreamer-plugins-bad1.0-0 \
+              libflite1 \
+              libwebpdemux2 \
+              libavif13 \
+              libwebpmux3 \
+              libmanette-0.2-0 \
+              libenchant-2-2 \
+              libhyphen0 \
+              libsecret-1-0 \
+              libwoff1 \
+              libx264-163 \
+              libsoup-3.0-0 \
+              gstreamer1.0-libav \
+              libicu70 \
+              libegl1 \
+              libepoxy0 \
+              libevdev2 \
+              libffi7 \
+              libfontconfig1 \
+              libfreetype6 \
+              libgdk-pixbuf-2.0-0 \
+              libgles2 \
+              libglib2.0-0 \
+              libglx0 \
+              libgstreamer1.0-0 \
+              libgudev-1.0-0 \
+              libharfbuzz-icu0 \
+              libharfbuzz0b \
+              libjpeg-turbo8 \
+              liblcms2-2 \
+              libnotify4 \
+              libopengl0 \
+              libopenjp2-7 \
+              libpng16-16 \
+              libproxy1v5 \
+              libwayland-client0 \
+              libwayland-egl1 \
+              libwayland-server0 \
+              libxml2 \
+              libxslt1.1 \
+              libatomic1
+
+            # Install the browser executables
+            pnpm playwright install
+          fi
+
+      - name: Determine Go version
+        id: get-go-version
+        run: |
+          echo "Building with Go $(cat ./support/src/${{matrix.folder_name}}/.go-version)"
+          echo "go-version=$(cat ./support/src/${{matrix.folder_name}}/.go-version)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ steps.get-go-version.outputs.go-version }}
+          cache: false
+
+      - name: Set up test infra
+        id: infra
+        run: |
+          ssh-keygen -N '' -t ed25519 -f ~/.ssh/github_enos
+          mkdir -p ./enos/terraform-plugin-cache
+
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            echo ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} > ./support/src/${{matrix.folder_name}}/internal/ui/VERSION
+            export ENOS_VAR_ui_build_override="oss"
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            echo ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} > ./support/src/${{matrix.folder_name}}/internal/ui/VERSION_ent
+            export ENOS_VAR_ui_build_override="enterprise"
+          fi
+
+          export ENOS_VAR_boundary_edition=${{ matrix.boundary_edition_short }} && \
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          export ENOS_VAR_boundary_license="${{ secrets.BOUNDARY_ENT_LICENSE }}" && \
+          enos scenario launch --timeout 60m0s --chdir ./support/src/${{matrix.folder_name}}/enos ${{matrix.enos_scenario}} builder:local
+
+      - name: Move boundary binary
+        run: |
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            mv ./support/src/${{matrix.folder_name}}/bin/boundary /usr/local/bin/
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            mv ./support/src/${{matrix.folder_name}}/bin/boundary $HOME/bin
+          fi
+
+          boundary version
+
+      - name: Run Tests
+        run: |
+          source <(bash ./support/src/${{matrix.folder_name}}/enos/scripts/test_e2e_env.sh)
+          cd e2e-tests
+          pnpm run ${{ matrix.test_command }} --project=${{ matrix.browser}} --reporter=html
+
+      - name: Upload Playwright report
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-report-${{ matrix.boundary_edition }}-${{ matrix.browser }}
+          path: e2e-tests/playwright-report
+
+      - name: Clean up test infra
+        if: ${{ always() }}
+        continue-on-error: true
+        run: |
+          export ENOS_VAR_boundary_edition=${{ matrix.boundary_edition_short }} && \
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          enos scenario destroy --timeout 60m0s --chdir ./support/src/${{matrix.folder_name}}/enos ${{matrix.enos_scenario}} builder:local
+
+      - name: Send Slack message on failure
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        if: ${{ failure() && github.repository == 'hashicorp/boundary-ui-enterprise' }}
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          payload: |
+            channel: ${{ secrets.SLACK_CHANNEL_ID }}
+            text: ":x: admin ui e2e tests (${{ matrix.boundary_edition }}:${{ matrix.browser }}) failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Branch:* ${{ github.repository }}:${{ github.head_ref || github.ref_name }}"

.github/workflows/test-e2e-desktop.yaml

@@ -0,0 +1,184 @@
+name: Test E2E Desktop Client
+
+on:
+  pull_request:
+    types: [labeled, opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      boundary-enterprise-branch:
+        description: 'Branch of boundary-enterprise to test against (default to main)'
+        required: true
+        default: 'main'
+        type: string
+      boundary-ui-enterprise-branch:
+        description: 'Branch of boundary-ui-enterprise to test against (default to main)'
+        required: true
+        default: 'main'
+        type: string
+
+jobs:
+  test:
+    name: test
+    # don't need to run e2e tests on ce -> ent merges since tests were already
+    # run in the ce branch, and there are currently no code differences between
+    # the two repos
+    # desktop client e2e tests only run enterprise tests, so only run in boundary-ui-enterprise
+    if: github.actor != 'hc-github-team-secure-boundary' && github.repository == 'hashicorp/boundary-ui-enterprise'
+    runs-on: ${{ fromJSON(vars.RUNNER_UBUNTU_22) }}
+    env:
+      ENOS_VAR_boundary_edition: "ent"
+      ENOS_VAR_e2e_debug_no_run: true
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
+        with:
+          cache: true
+          cache_dependency_path: |
+            pnpm-lock.yaml
+            ui/desktop/electron-app/pnpm-lock.yaml
+          run_install: false
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e
+
+      - name: Set up Enos
+        uses: hashicorp/action-setup-enos@6ec106c8f809fe645162d73bea565c65f3269907
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Vault CLI
+        run: |
+          wget https://releases.hashicorp.com/vault/1.17.6/vault_1.17.6_linux_amd64.zip -O /tmp/vault.zip
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            unzip -o -q /tmp/vault.zip -d /usr/local/bin
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            unzip -o -q /tmp/vault.zip -d "$HOME/bin"
+          fi
+
+        # TODO: We should consider modifying to also build CE binary. For now
+        # building ENT binary using most recent UI commit is sufficient.
+      - name: Checkout boundary-enterprise
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: hashicorp/boundary-enterprise
+          ref: ${{ github.event.inputs.boundary-enterprise-branch || 'main' }}
+          path: support/src/boundary-enterprise
+          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+
+      - name: Checkout boundary-ui-enterprise
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: hashicorp/boundary-ui-enterprise
+          ref: ${{ github.event.inputs.boundary-ui-enterprise-branch || 'main' }}
+          path: support/src/boundary-ui-enterprise
+          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+
+      - name: Use boundary-ui-enterprise commit SHA for building binary
+        run: |
+          cd support/src/boundary-ui-enterprise
+          git rev-parse HEAD > ../boundary-enterprise/internal/ui/VERSION_ent
+
+      - name: GH fix for localhost resolution
+        run: |
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            cat /etc/hosts && echo "-----------"
+            sudo sed -i 's/::1 *localhost ip6-localhost ip6-loopback/::1 ip6 -localhost ip6-loopback/g' /etc/hosts
+            cat /etc/hosts
+            ssh -V
+          fi
+
+      - name: Set git config
+        run: |
+          git config --global url."https://oauth2:${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com".insteadOf "https://github.com"
+
+      - name: Determine Go version
+        id: get-go-version
+        run: |
+          echo "Building with Go $(cat ./support/src/boundary-enterprise/.go-version)"
+          echo "go-version=$(cat ./support/src/boundary-enterprise/.go-version)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ steps.get-go-version.outputs.go-version }}
+          cache: false
+
+      - name: Set up test infra
+        id: infra
+        run: |
+          ssh-keygen -N '' -t ed25519 -f ~/.ssh/github_enos
+          mkdir -p ./enos/terraform-plugin-cache
+          export ENOS_VAR_ui_build_override="ent" && \
+          export ENOS_VAR_boundary_edition="ent" && \
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          export ENOS_VAR_boundary_license="${{ secrets.BOUNDARY_ENT_LICENSE }}" && \
+          enos scenario launch --timeout 60m0s --chdir ./support/src/boundary-enterprise/enos e2e_ui_docker_ent builder:local
+
+      - name: Move boundary binary
+        run: |
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            mv ./support/src/boundary-enterprise/bin/boundary /usr/local/bin/
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            mv ./support/src/boundary-enterprise/bin/boundary $HOME/bin
+          fi
+          boundary version
+
+      - name: Install dependencies
+        run: |
+          pnpm install --frozen-lockfile
+          cd e2e-tests
+          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
+            pnpm playwright install --with-deps
+          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
+            # playwright dependencies can't be installed on a self-hosted runner
+            # due to permission issues
+            pnpm playwright install
+
+            sudo apt update -qq
+            sudo apt install xvfb -y
+          fi
+
+        # Runner is headless so we need to enable a display to run the client
+      - name: Run Tests
+        run: |
+          source <(bash ./support/src/boundary-enterprise/enos/scripts/test_e2e_env.sh)
+          cd e2e-tests
+
+          export DISPLAY=:99
+          Xvfb -ac :99 -screen 0 1280x1024x24 > /dev/null 2>&1 &
+          pnpm run desktop
+
+      - name: Upload Playwright report
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-report
+          path: e2e-tests/playwright-report
+
+      - name: Clean up test infra
+        if: ${{ always() }}
+        continue-on-error: true
+        run: |
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          enos scenario destroy --timeout 60m0s --chdir ./support/src/boundary-enterprise/enos e2e_ui_docker_ent builder:local
+
+      - name: Send Slack message on failure
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        if: ${{ failure() && github.repository == 'hashicorp/boundary-ui-enterprise' }}
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          payload: |
+            channel: ${{ secrets.SLACK_CHANNEL_ID }}
+            text: ":x: desktop client e2e tests failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Branch:* ${{ github.repository }}:${{ github.head_ref || github.ref_name }}"

.github/workflows/test-release-trigger.yml

@@ -1,25 +0,0 @@
-name: "Trigger Test Boundary UI release"
-
-on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
-        required: true
-
-jobs:
-  trigger-gha-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Release description
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
-      - name: Trigger Release workflow in boundary-ui-releases
-        run: |
-          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
-          gh workflow run release.yml \
-          --repo hashicorp/boundary-ui-releases \
-          --ref main \
-          -f TAG="${{ github.event.inputs.branch }}"
-

.github/workflows/ui-release-trigger.yml

@@ -1,4 +1,4 @@
-name: "Trigger Boundary UI release"
+name: "Trigger Boundary Desktop release"
 
 on:
   push:
@@ -7,16 +7,16 @@ on:
 
 jobs:
   trigger-gha-release:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Release description
         run: |
           echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
-      - name: Trigger Release workflow in boundary-ui-releases
+      - name: Trigger Release workflow in boundary-desktop-releases
         run: |
           export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
           gh workflow run release.yml \
-          --repo hashicorp/boundary-ui-releases \
+          --repo hashicorp/boundary-desktop-releases \
           --ref main \
           -f TAG="${GITHUB_REF#refs/tags/}"

.gitignore

@@ -19,5 +19,23 @@ coverage-*
 libpeerconnection.log
 npm-debug.log*
 testem.log
-yarn-error.log
 .watchman-cookie*
+
+### VisualStudioCode ###
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+!.vscode/*.code-snippets
+
+# Local History for Visual Studio Code
+.history/
+
+# Built Visual Studio Code Extensions
+*.vsix
+
+### VisualStudioCode Patch ###
+# Ignore all local history of files
+.history
+.ionide

.husky/pre-commit

@@ -1,5 +1,2 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-yarn compliance:licenses
-npx lint-staged
+pnpm compliance:licenses
+pnpm lint-staged

.husky/prepare-commit-msg

@@ -1,16 +1,23 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
 COMMIT_MSG_FILE=$1
 COMMIT_SOURCE=$2
 SHA1=$3
 # Gets the current branch name but if we're in a detached head state, return "HEAD"
 BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
+# Regex to match the ICU-#### branch name pattern we use
+ISSUE_REGEX="^(ICU-[0-9]+)"
 
 # Don't run commitizen for merge or squash commits, as well as when rebasing
 if [ "${COMMIT_SOURCE}" = merge ] || [ "${COMMIT_SOURCE}" = squash ] || [ "${COMMIT_SOURCE}" = "message" -a "${BRANCH_NAME}" = "HEAD" ];then
     exit 0
 fi
 
-# This is to allow interaction with the terminal for commitizen
-exec < /dev/tty && npx git-cz --hook || true
+# If the branch name matches, set the JIRA link automatically
+if [[ $BRANCH_NAME =~ $ISSUE_REGEX ]]
+then
+  issue="${BASH_REMATCH[1]}"
+  url="https://hashicorp.atlassian.net/browse/${issue}"
+  exec < /dev/tty && npx git-cz --issues="$url" --hook || true
+else
+  # This is to allow interaction with the terminal for commitizen
+  exec < /dev/tty && npx git-cz --hook || true
+fi

.release/release-metadata.hcl

@@ -1,5 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: BUSL-1.1
 
 url_license = "https://github.com/hashicorp/boundary-ui/blob/main/LICENSE"
 url_project_website = "https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app"

LICENSE

@@ -1,364 +1,91 @@
-Copyright (c) 2020 HashiCorp, Inc.
-
-Mozilla Public License, version 2.0
-
-1. Definitions
-
-1.1. "Contributor"
-
-     means each individual or legal entity that creates, contributes to the
-     creation of, or owns Covered Software.
-
-1.2. "Contributor Version"
-
-     means the combination of the Contributions of others (if any) used by a
-     Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution"
-
-     means Covered Software of a particular Contributor.
-
-1.4. "Covered Software"
-
-     means Source Code Form to which the initial Contributor has attached the
-     notice in Exhibit A, the Executable Form of such Source Code Form, and
-     Modifications of such Source Code Form, in each case including portions
-     thereof.
-
-1.5. "Incompatible With Secondary Licenses"
-     means
-
-     a. that the initial Contributor has attached the notice described in
-        Exhibit B to the Covered Software; or
-
-     b. that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the terms of
-        a Secondary License.
-
-1.6. "Executable Form"
-
-     means any form of the work other than Source Code Form.
-
-1.7. "Larger Work"
-
-     means a work that combines Covered Software with other material, in a
-     separate file or files, that is not Covered Software.
-
-1.8. "License"
-
-     means this document.
-
-1.9. "Licensable"
-
-     means having the right to grant, to the maximum extent possible, whether
-     at the time of the initial grant or subsequently, any and all of the
-     rights conveyed by this License.
-
-1.10. "Modifications"
-
-     means any of the following:
-
-     a. any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered Software; or
-
-     b. any new file in Source Code Form that contains any Covered Software.
-
-1.11. "Patent Claims" of a Contributor
-
-      means any patent claim(s), including without limitation, method,
-      process, and apparatus claims, in any patent Licensable by such
-      Contributor that would be infringed, but for the grant of the License,
-      by the making, using, selling, offering for sale, having made, import,
-      or transfer of either its Contributions or its Contributor Version.
-
-1.12. "Secondary License"
-
-      means either the GNU General Public License, Version 2.0, the GNU Lesser
-      General Public License, Version 2.1, the GNU Affero General Public
-      License, Version 3.0, or any later versions of those licenses.
-
-1.13. "Source Code Form"
-
-      means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your")
-
-      means an individual or a legal entity exercising rights under this
-      License. For legal entities, "You" includes any entity that controls, is
-      controlled by, or is under common control with You. For purposes of this
-      definition, "control" means (a) the power, direct or indirect, to cause
-      the direction or management of such entity, whether by contract or
-      otherwise, or (b) ownership of more than fifty percent (50%) of the
-      outstanding shares or beneficial ownership of such entity.
-
-
-2. License Grants and Conditions
-
-2.1. Grants
-
-     Each Contributor hereby grants You a world-wide, royalty-free,
-     non-exclusive license:
-
-     a. under intellectual property rights (other than patent or trademark)
-        Licensable by such Contributor to use, reproduce, make available,
-        modify, display, perform, distribute, and otherwise exploit its
-        Contributions, either on an unmodified basis, with Modifications, or
-        as part of a Larger Work; and
-
-     b. under Patent Claims of such Contributor to make, use, sell, offer for
-        sale, have made, import, and otherwise transfer either its
-        Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-     The licenses granted in Section 2.1 with respect to any Contribution
-     become effective for each Contribution on the date the Contributor first
-     distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-     The licenses granted in this Section 2 are the only rights granted under
-     this License. No additional rights or licenses will be implied from the
-     distribution or licensing of Covered Software under this License.
-     Notwithstanding Section 2.1(b) above, no patent license is granted by a
-     Contributor:
-
-     a. for any code that a Contributor has removed from Covered Software; or
-
-     b. for infringements caused by: (i) Your and any other third party's
-        modifications of Covered Software, or (ii) the combination of its
-        Contributions with other software (except as part of its Contributor
-        Version); or
-
-     c. under Patent Claims infringed by Covered Software in the absence of
-        its Contributions.
-
-     This License does not grant any rights in the trademarks, service marks,
-     or logos of any Contributor (except as may be necessary to comply with
-     the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-     No Contributor makes additional grants as a result of Your choice to
-     distribute the Covered Software under a subsequent version of this
-     License (see Section 10.2) or under the terms of a Secondary License (if
-     permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-     Each Contributor represents that the Contributor believes its
-     Contributions are its original creation(s) or it has sufficient rights to
-     grant the rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-     This License is not intended to limit any rights You have under
-     applicable copyright doctrines of fair use, fair dealing, or other
-     equivalents.
-
-2.7. Conditions
-
-     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
-     Section 2.1.
-
-
-3. Responsibilities
-
-3.1. Distribution of Source Form
-
-     All distribution of Covered Software in Source Code Form, including any
-     Modifications that You create or to which You contribute, must be under
-     the terms of this License. You must inform recipients that the Source
-     Code Form of the Covered Software is governed by the terms of this
-     License, and how they can obtain a copy of this License. You may not
-     attempt to alter or restrict the recipients' rights in the Source Code
-     Form.
-
-3.2. Distribution of Executable Form
-
-     If You distribute Covered Software in Executable Form then:
-
-     a. such Covered Software must also be made available in Source Code Form,
-        as described in Section 3.1, and You must inform recipients of the
-        Executable Form how they can obtain a copy of such Source Code Form by
-        reasonable means in a timely manner, at a charge no more than the cost
-        of distribution to the recipient; and
-
-     b. You may distribute such Executable Form under the terms of this
-        License, or sublicense it under different terms, provided that the
-        license for the Executable Form does not attempt to limit or alter the
-        recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-     You may create and distribute a Larger Work under terms of Your choice,
-     provided that You also comply with the requirements of this License for
-     the Covered Software. If the Larger Work is a combination of Covered
-     Software with a work governed by one or more Secondary Licenses, and the
-     Covered Software is not Incompatible With Secondary Licenses, this
-     License permits You to additionally distribute such Covered Software
-     under the terms of such Secondary License(s), so that the recipient of
-     the Larger Work may, at their option, further distribute the Covered
-     Software under the terms of either this License or such Secondary
-     License(s).
-
-3.4. Notices
-
-     You may not remove or alter the substance of any license notices
-     (including copyright notices, patent notices, disclaimers of warranty, or
-     limitations of liability) contained within the Source Code Form of the
-     Covered Software, except that You may alter any license notices to the
-     extent required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-     You may choose to offer, and to charge a fee for, warranty, support,
-     indemnity or liability obligations to one or more recipients of Covered
-     Software. However, You may do so only on Your own behalf, and not on
-     behalf of any Contributor. You must make it absolutely clear that any
-     such warranty, support, indemnity, or liability obligation is offered by
-     You alone, and You hereby agree to indemnify every Contributor for any
-     liability incurred by such Contributor as a result of warranty, support,
-     indemnity or liability terms You offer. You may include additional
-     disclaimers of warranty and limitations of liability specific to any
-     jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
-   If it is impossible for You to comply with any of the terms of this License
-   with respect to some or all of the Covered Software due to statute,
-   judicial order, or regulation then You must: (a) comply with the terms of
-   this License to the maximum extent possible; and (b) describe the
-   limitations and the code they affect. Such description must be placed in a
-   text file included with all distributions of the Covered Software under
-   this License. Except to the extent prohibited by statute or regulation,
-   such description must be sufficiently detailed for a recipient of ordinary
-   skill to be able to understand it.
-
-5. Termination
-
-5.1. The rights granted under this License will terminate automatically if You
-     fail to comply with any of its terms. However, if You become compliant,
-     then the rights granted under this License from a particular Contributor
-     are reinstated (a) provisionally, unless and until such Contributor
-     explicitly and finally terminates Your grants, and (b) on an ongoing
-     basis, if such Contributor fails to notify You of the non-compliance by
-     some reasonable means prior to 60 days after You have come back into
-     compliance. Moreover, Your grants from a particular Contributor are
-     reinstated on an ongoing basis if such Contributor notifies You of the
-     non-compliance by some reasonable means, this is the first time You have
-     received notice of non-compliance with this License from such
-     Contributor, and You become compliant prior to 30 days after Your receipt
-     of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-     infringement claim (excluding declaratory judgment actions,
-     counter-claims, and cross-claims) alleging that a Contributor Version
-     directly or indirectly infringes any patent, then the rights granted to
-     You by any and all Contributors for the Covered Software under Section
-     2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
-     license agreements (excluding distributors and resellers) which have been
-     validly granted by You or Your distributors under this License prior to
-     termination shall survive termination.
-
-6. Disclaimer of Warranty
-
-   Covered Software is provided under this License on an "as is" basis,
-   without warranty of any kind, either expressed, implied, or statutory,
-   including, without limitation, warranties that the Covered Software is free
-   of defects, merchantable, fit for a particular purpose or non-infringing.
-   The entire risk as to the quality and performance of the Covered Software
-   is with You. Should any Covered Software prove defective in any respect,
-   You (not any Contributor) assume the cost of any necessary servicing,
-   repair, or correction. This disclaimer of warranty constitutes an essential
-   part of this License. No use of  any Covered Software is authorized under
-   this License except under this disclaimer.
-
-7. Limitation of Liability
-
-   Under no circumstances and under no legal theory, whether tort (including
-   negligence), contract, or otherwise, shall any Contributor, or anyone who
-   distributes Covered Software as permitted above, be liable to You for any
-   direct, indirect, special, incidental, or consequential damages of any
-   character including, without limitation, damages for lost profits, loss of
-   goodwill, work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses, even if such party shall have been
-   informed of the possibility of such damages. This limitation of liability
-   shall not apply to liability for death or personal injury resulting from
-   such party's negligence to the extent applicable law prohibits such
-   limitation. Some jurisdictions do not allow the exclusion or limitation of
-   incidental or consequential damages, so this exclusion and limitation may
-   not apply to You.
-
-8. Litigation
-
-   Any litigation relating to this License may be brought only in the courts
-   of a jurisdiction where the defendant maintains its principal place of
-   business and such litigation shall be governed by laws of that
-   jurisdiction, without reference to its conflict-of-law provisions. Nothing
-   in this Section shall prevent a party's ability to bring cross-claims or
-   counter-claims.
-
-9. Miscellaneous
-
-   This License represents the complete agreement concerning the subject
-   matter hereof. If any provision of this License is held to be
-   unenforceable, such provision shall be reformed only to the extent
-   necessary to make it enforceable. Any law or regulation which provides that
-   the language of a contract shall be construed against the drafter shall not
-   be used to construe this License against a Contributor.
-
-
-10. Versions of the License
-
-10.1. New Versions
-
-      Mozilla Foundation is the license steward. Except as provided in Section
-      10.3, no one other than the license steward has the right to modify or
-      publish new versions of this License. Each version will be given a
-      distinguishing version number.
-
-10.2. Effect of New Versions
-
-      You may distribute the Covered Software under the terms of the version
-      of the License under which You originally received the Covered Software,
-      or under the terms of any subsequent version published by the license
-      steward.
-
-10.3. Modified Versions
-
-      If you create software not governed by this License, and you want to
-      create a new license for such software, you may create and use a
-      modified version of this License if you rename the license and remove
-      any references to the name of the license steward (except to note that
-      such modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary
-      Licenses If You choose to distribute Source Code Form that is
-      Incompatible With Secondary Licenses under the terms of this version of
-      the License, the notice described in Exhibit B of this License must be
-      attached.
-
-Exhibit A - Source Code Form License Notice
-
-      This Source Code Form is subject to the
-      terms of the Mozilla Public License, v.
-      2.0. If a copy of the MPL was not
-      distributed with this file, You can
-      obtain one at
-      http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file,
-then You may include the notice in a location (such as a LICENSE file in a
-relevant directory) where a recipient would be likely to look for such a
-notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - "Incompatible With Secondary Licenses" Notice
-
-      This Source Code Form is "Incompatible
-      With Secondary Licenses", as defined by
-      the Mozilla Public License, v. 2.0.
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             International Business Machines Corporation (IBM)
+Licensed Work:        The Licensed Work is (c) 2024 IBM Corp.
+Additional Use Grant: You may make production use of the Licensed Work, provided
+                      Your use does not include offering the Licensed Work to third
+                      parties on a hosted or embedded basis in order to compete with 
+                      IBM Corp's paid version(s) of the Licensed Work. For purposes 
+                      of this license:
+
+                      A "competitive offering" is a Product that is offered to third
+                      parties on a paid basis, including through paid support 
+                      arrangements, that significantly overlaps with the capabilities 
+                      of IBM Corp's paid version(s) of the Licensed Work. If Your 
+                      Product is not a competitive offering when You first make it 
+                      generally available, it will not become a competitive offering
+                      later due to IBM Corp releasing a new version of the Licensed 
+                      Work with additional capabilities. In addition, Products that 
+                      are not provided on a paid basis are not competitive.
+
+                      "Product" means software that is offered to end users to manage 
+                      in their own environments or offered as a service on a hosted 
+                      basis.
+
+                      "Embedded" means including the source code or executable code 
+                      from the Licensed Work in a competitive offering. "Embedded" 
+                      also means packaging the competitive offering in such a way 
+                      that the Licensed Work must be accessed or downloaded for the 
+                      competitive offering to operate.
+
+                      Hosting or using the Licensed Work(s) for internal purposes 
+                      within an organization is not considered a competitive 
+                      offering. IBM Corp considers your organization to include all 
+                      of your affiliates under common control.
+
+                      For binding interpretive guidance on using IBM Corp products 
+                      under the Business Source License, please visit our FAQ. 
+                      (https://www.hashicorp.com/license-faq)
+Change Date:          Four years from the date the Licensed Work is published.
+Change License:       MPL 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact licensing@hashicorp.com.
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.

README.md

@@ -25,7 +25,7 @@ subproject, e.g. running or testing.
   - [Prerequisites](#prerequisites)
   - [Optional Tooling](#optional-tooling)
   - [Installation](#installation)
-  - [Yarn Commands](#yarn-commands)
+  - [Pnpm Commands](#pnpm-commands)
   - [Contributing](#contributing)
     - [Branching](#branching)
     - [Building ToC](#building-toc)
@@ -33,8 +33,8 @@ subproject, e.g. running or testing.
       - [Building with a Container](#building-with-a-container)
     - [Building Desktop UI for Production](#building-desktop-ui-for-production)
     - [Connect Boundary UI to Boundary local instance](#connect-boundary-ui-to-boundary-local-instance)
-      - [For admin](#for-admin)
-      - [For desktop](#for-desktop)
+      - [For Admin](#for-admin)
+      - [For Desktop](#for-desktop)
     - [Committing](#committing)
       - [License Checking](#license-checking)
 
@@ -67,8 +67,8 @@ You will need the following things properly installed on your computer.
 
 * [Git][git]
 * [Node.js][node]
-  * Supported versions: `v16` and `v18`.
-* [Yarn][yarn] installed globally
+  * Supported versions: `v20` and `v22`.
+* [Pnpm][pnpm] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]
 
@@ -90,18 +90,18 @@ that best suit you and your personal style.
 
 * `git clone <repository-url>` this repository
 * `cd boundary-ui`
-* `yarn install`
+* `pnpm install`
 
-## Yarn Commands
+## Pnpm Commands
 
-List of available project commands.  `yarn run <command-name>`
+List of available project commands.  `pnpm run <command-name>`
 
 | Command             | Description |
 |---------------------|---|
-| build               | Builds Admin UI. |
+| build               | Builds Admin UI for production. |
 | test                | Runs tests in CI mode. |
 | lint                | Runs ember-template-lint on all of the hbs, js, and sass files. |
-| compliance:audit    | Checks for issues using `yarn audit` with moderate and above criticality.|
+| compliance:audit    | Checks for issues using `pnpm audit` with moderate and above criticality.|
 | compliance:licenses | Checks that all dependencies have OSS-compatible licenses. |
 | doc:toc             | Automatically generates a table of contents for the README file. |
 
@@ -114,20 +114,20 @@ We follow [GitHub Flow][github-flow].
 ### Building ToC
 
 To autogenerate a ToC (table of contents) for this README,
-run `yarn doc:toc`.  Please update the ToC whenever editing the structure
+run `pnpm doc:toc`.  Please update the ToC whenever editing the structure
 of README.
 
 ### Building Admin UI for Production
 
-See ui/admin/README.md Building for Production for more information on how to
-build the Admin UI.  Be sure to set build-related environment variables as
-necessary for your target environment, as described in the Admin UI readme.
+See [Admin UI README](ui/admin/README.md#building-for-production) for more information on how to
+build the Admin UI for production.  Be sure to set build-related environment variables as
+necessary for your target environment, as described in the [Environment Variables](ui/admin/README.md#environment-variables) section of README.
 
 To quickly produce a production build of Admin UI, run from this folder:
 
 ```bash
-yarn install
-yarn build
+pnpm install
+pnpm build
 ```
 
 Assets are saved to `ui/admin/dist/`.
@@ -144,27 +144,27 @@ Assets are saved to `ui/admin/dist/`.
 
 ### Building Desktop UI for Production
 
-See ui/desktop/README.md Building for Production for more information on how to
+See [Desktop UI README](ui/desktop/README.md#building-for-production) for more information on how to
 build the Desktop UI.  Be sure to set build-related environment variables as
-necessary for your target environment, as described in the Desktop UI readme.
+necessary for your target environment, as described in the [Environment Variables](ui/desktop/README.md#environment-variables-prod) section of README.
 
 To quickly produce a production build of Desktop UI, run from this folder:
 
 ```bash
-yarn install
-yarn build:ui:desktop
+pnpm install
+pnpm build:ui:desktop
 ```
 
 In windows, UI is generated using docker to provide a stable UI across platforms.
 
 ```cmd
-yarn install
+pnpm install
 docker-compose -f docker-compose-embedding.yml run build-desktop-production
-yarn build:ui:desktop:app
+pnpm build:ui:desktop:app
 ```
 
 To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY`
-environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `yarn build:ui:desktop:app`.
+environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `pnpm build:ui:desktop:app`.
 
 Assets are saved to `ui/desktop/electron-app/out/make/`.
 DMG packaged desktop UI is available at asset location as `boundary.dmg`.
@@ -174,22 +174,23 @@ EXE archived desktop UI is available at asset location under `zip` folder.
 
 This describes how to connect local Boundary UI to your local instance of Boundary.
 
-This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://learn.hashicorp.com/tutorials/boundary/getting-started-dev?in=boundary/getting-started#start-a-dev-environment).
-#### For admin
+This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://developer.hashicorp.com/boundary/tutorials/get-started-community/community-get-started-dev)
+
+#### For Admin
 
 This assumes you are within `boundary-ui/ui/admin`.
 
-You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 yarn start`.
+You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 pnpm start`.
 
 Following terminal instructions, open in your browser: `http://localhost:4200/`.
 
 Once you open the UI you will see the login screen, authenticate using generated admin login name and password.
 
-#### For desktop
+#### For Desktop
 
 This assumes you are within `boundary-ui/ui/desktop`.
 
-You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false yarn start:desktop`.
+You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false pnpm start:desktop`.
 
 In login screen, authenticate using generated admin login name and password.
 
@@ -198,7 +199,7 @@ Enter the cluster URL of your Boundary dev instance, by default is: `http://loca
 ### Committing
 
 We use `husky` and `lint-staged` to ensure linting and other checks pass before a
-commit is completed. Simply do a `yarn install` to make sure the hooks are installed.
+commit is completed. Simply do a `pnpm install` to make sure the hooks are installed.
 
 Use a normal `git commit` to go through the checks, if you need to skip these checks,
 use `git commit --no-verify` to bypass them. However, a consistent commit message will
@@ -217,10 +218,10 @@ will not be accepted.
 
 [git]: https://git-scm.com/
 [node]: https://nodejs.org/
-[yarn]: https://classic.yarnpkg.com/lang/en/
+[pnpm]: https://pnpm.io
 [chrome]: https://google.com/chrome/
 [firefox]: https://firefox.com/
-[yarn-workspaces]: https://classic.yarnpkg.com/en/docs/workspaces/
+[pnpm-workspaces]: https://pnpm.io/workspaces
 [homebrew]: https://brew.sh
 [warp]: https://www.warp.dev
 [vscode]: https://code.visualstudio.com/

addons/api/.editorconfig

@@ -12,8 +12,8 @@ insert_final_newline = true
 indent_style = space
 indent_size = 2
 
-[*.{diff,md}]
-trim_trailing_whitespace = false
-
 [*.hbs]
 insert_final_newline = false
+
+[*.{diff,md}]
+trim_trailing_whitespace = false

addons/api/.ember-cli

@@ -1,12 +1,4 @@
 {
-  /**
-    Ember CLI sends analytics information by default. The data is completely
-    anonymous, but there are times when you might want to disable this behavior.
-
-    Setting `disableAnalytics` to true will prevent any data from being sent.
-  */
-  "disableAnalytics": false,
-
   /**
     Setting `isTypeScriptProject` to true will force the blueprint generators to generate TypeScript
     rather than JavaScript by default, when a TypeScript version of a given blueprint is available.

addons/api/.eslintignore

@@ -1,25 +0,0 @@
-# unconventional js
-/blueprints/*/files/
-/vendor/
-
-# compiled output
-/dist/
-/tmp/
-
-# dependencies
-/bower_components/
-/node_modules/
-
-# misc
-/coverage/
-!.*
-.*/
-.eslintcache
-
-# ember-try
-/.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
-/package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try

addons/api/.eslintrc.js

@@ -1,65 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
- */
-
-'use strict';
-
-module.exports = {
-  root: true,
-  parser: '@babel/eslint-parser',
-  parserOptions: {
-    ecmaVersion: 'latest',
-    sourceType: 'module',
-    // This is specific babel-config. If grows consider creating a babel config file
-    requireConfigFile: false,
-    babelOptions: {
-      plugins: [
-        ['@babel/plugin-proposal-decorators', { decoratorsBeforeExport: true }],
-      ],
-    },
-    // end of babel-config
-  },
-  plugins: ['ember'],
-  extends: ['eslint:recommended', 'plugin:ember/recommended', 'prettier'],
-  env: {
-    browser: true,
-  },
-  rules: {
-    'ember/no-get': 'off',
-    'ember/no-get-with-default': 'off',
-    'ember/no-computed-properties-in-native-classes': 'off',
-    'ember/no-assignment-of-untracked-properties-used-in-tracking-contexts':
-      'off',
-  },
-  overrides: [
-    // node files
-    {
-      files: [
-        './.eslintrc.js',
-        './.prettierrc.js',
-        './.stylelintrc.js',
-        './.template-lintrc.js',
-        './ember-cli-build.js',
-        './index.js',
-        './testem.js',
-        './blueprints/*/index.js',
-        './config/**/*.js',
-        './tests/dummy/config/**/*.js',
-      ],
-      parserOptions: {
-        sourceType: 'script',
-      },
-      env: {
-        browser: false,
-        node: true,
-      },
-      extends: ['plugin:n/recommended'],
-    },
-    {
-      // Test files:
-      files: ['tests/**/*-test.{js,ts}'],
-      extends: ['plugin:qunit/recommended'],
-    },
-  ],
-};

addons/api/.gitignore

@@ -0,0 +1,20 @@
+# compiled output
+/dist/
+/declarations/
+
+# dependencies
+/node_modules/
+
+# misc
+/.env*
+/.pnp*
+/.eslintcache
+/coverage/
+/testem.log
+
+# ember-try
+/.node_modules.ember-try/
+/package.json.ember-try
+
+# broccoli-debug
+/DEBUG/

addons/api/.npmignore

@@ -2,11 +2,7 @@
 /dist/
 /tmp/
 
-# dependencies
-/bower_components/
-
 # misc
-/.bowerrc
 /.editorconfig
 /.ember-cli
 /.env*
@@ -19,21 +15,15 @@
 /.prettierignore
 /.prettierrc.js
 /.template-lintrc.js
-/.travis.yml
 /.watchmanconfig
-/bower.json
 /CONTRIBUTING.md
 /ember-cli-build.js
 /testem.js
 /tests/
-/yarn-error.log
-/yarn.lock
+/tsconfig.declarations.json
+/tsconfig.json
 .gitkeep
 
 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
 /package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try

addons/api/.prettierignore

@@ -1,25 +1,13 @@
 # unconventional js
 /blueprints/*/files/
-/vendor/
 
 # compiled output
 /dist/
-/tmp/
-
-# dependencies
-/bower_components/
-/node_modules/
 
 # misc
 /coverage/
 !.*
-.eslintcache
-.lint-todo/
+.*/
 
 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
-/package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try

addons/api/.prettierrc.js

@@ -1,8 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
+'use strict';
+
 module.exports = {
   overrides: [
     {

addons/api/.template-lintrc.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 'use strict';

addons/api/.watchmanconfig

@@ -1,3 +1,3 @@
 {
-  "ignore_dirs": ["tmp", "dist"]
+  "ignore_dirs": ["dist"]
 }

addons/api/README.md

@@ -8,7 +8,7 @@ This addon contains the API data access layer for Boundary.
 
 - [Add API to an App](#add-api-to-an-app)
 - [Installation](#installation)
-- [Yarn Commands](#yarn-commands)
+- [Pnpm Commands](#pnpm-commands)
 - [Linting](#linting)
 - [Formatting](#formatting)
 - [Running tests](#running-tests)
@@ -21,26 +21,59 @@ This addon contains the API data access layer for Boundary.
 ## Add API to an App
 
 Add this addon to an Ember application's `devDependencies` as:
-`"api": "*"`, for applications included in this monorepo.
+`"api": "workspace:*"`, for applications included in this monorepo. 
 
-Since this addon also includes Mirage mocks, be sure to install
-`ember-cli-mirage` and add the following config to your UI project:
+This addon also includes Mirage mocks. To include the `miragejs` dependency and this addon's mirage handlers configure the consuming app's `config/environment.js`
 
 ```js
-'ember-cli-mirage': {
-  directory: '../../addons/api/mirage'
+mirage: {
+  enabled: true
 }
 ```
 
+Include `miragejs` and any api addon `peerDependencies` used by the mirage as dev dependencies in the consuming app,
+eg: `@faker-js/faker`, otherwise mirage handler code might fail with an error.
+
+To have mirage start and intercept requests when the application starts:
+1. Add the `@embroider/macros` dependency to your application
+2. Configure `@embroider/macros` with `startMirageWithApp` based on app's config within `ember-cli-build.js`:
+
+```js
+// ember-cli-build.js
+module.exports = async function (defaults) {
+  // load the app's config 
+  const { EMBER_ENV } = process.env;
+  var config = require('./config/environment')(EMBER_ENV);
+
+  const app = new EmberApp(defaults, {
+    '@embroider/macros': {
+      setOwnConfig: {
+        startMirageWithApp: config.mirage?.enabled ?? false
+      },
+    },
+  });
+}
+```
+
+3. Finally, use the `@embroider/macros` config value for `startMirageWithApp` in `app/app.js` to conditionally start mirage:
+
+```js
+import { macroCondition, importSync, getOwnConfig, isTesting } from '@embroider/macros';
+
+if (macroCondition(getOwnConfig().startMirageWithApp && !isTesting())) {
+  const startServer = importSync('[name of host app]/mirage/config').default;
+  startServer({});
+}
+```
 ## Installation
 
 See monorepo README for installation instructions.
 
 When manually installing addon, ensure `ember-data-fragments@5.0.0-beta.*` is installed to use api models with data fragments.
 
-## Yarn Commands
+## Pnpm Commands
 
-List of available project commands.  `yarn run <command-name>`
+List of available project commands.  `pnpm run <command-name>`
 
 | Command | Description |
 | ------- | ----------- |
@@ -64,28 +97,28 @@ Additional commands in the monorepo package may affect this projects.
 
 ## Linting
 
-* `yarn lint:fix`
-* `yarn lint:hbs`
-* `yarn lint:hbs:fix`
-* `yarn lint:js`
-* `yarn lint:js:fix`
+* `pnpm lint:fix`
+* `pnpm lint:hbs`
+* `pnpm lint:hbs:fix`
+* `pnpm lint:js`
+* `pnpm lint:js:fix`
 
 ## Formatting
 
 Before submitting your work, be sure to run auto-formatters
 (see commands above).  This helps to ensure consistency among authors.
 
-* `yarn format`
+* `pnpm format`
 
 ## Running tests
 
-* `yarn test` – Runs the test suite on the current Ember version
-* `yarn test --server` – Runs the test suite in "watch mode"
-* `yarn test:all` – Runs the test suite against multiple Ember versions
+* `pnpm test` – Runs the test suite on the current Ember version
+* `pnpm test --server` – Runs the test suite in "watch mode"
+* `pnpm test:all` – Runs the test suite against multiple Ember versions
 
 ## Running the dummy application
 
-* `yarn start`
+* `pnpm start`
 * Visit the dummy application at [http://localhost:4200](http://localhost:4200).
 
 ## Contributing
@@ -95,5 +128,5 @@ See monorepo README for more contribution instructions.
 ### Building ToC
 
 To autogenerate a ToC (table of contents) for this README,
-run `yarn doc:toc`.  Please update the ToC whenever editing the structure
+run `pnpm doc:toc`.  Please update the ToC whenever editing the structure
 of README.

addons/api/addon-test-support/handlers/cache-daemon-search.js

@@ -0,0 +1,107 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import sinon from 'sinon';
+import { typeOf } from '@ember/utils';
+import { resourceNames } from 'api/handlers/cache-daemon-handler';
+import { singularize } from 'ember-inflector';
+import { underscore } from '@ember/string';
+
+/**
+ * This test helper can be used to help setup your sinon stubs in your tests.
+ * Must be called after setupMirage and setupDesktopContextBridgeApiMock in tests.
+ *
+ * ```js
+ * import setupStubs from 'api/test-support/handlers/cache-daemon-search';
+ *
+ * module('Acceptance | my test', function(hooks) {
+ *  setupApplicationTest(hooks);
+ *  setupMirage(hooks);
+ *  setupDesktopContextBridgeApiMock(hooks);
+ *  setupStubs(hooks);
+ *
+ *   // add your actual tests here
+ * });
+ * ```
+ *
+ * This will setup a stub for window.desktop.daemon.searchCacheDaemon and include
+ * helper methods to help setup what the cache daemon search command returns.
+ *
+ * @module Test Helpers
+ * @public
+ */
+export default function setupStubs(hooks) {
+  let stubTypes = [];
+
+  hooks.beforeEach(function () {
+    /**
+     * We aim to still use mirage data when stubbing out the cache daemon
+     * search. However, the handler expects the search data to be raw JSON from
+     * the API which will get serialized. We add back the scope object for it to
+     * get correctly normalized and other fields such as "attributes" from the
+     * API will already be hoisted and will not be re-normalized from mirage data.
+     *
+     * This convenience method can take in multiple types,
+     * e.g. this.stubCacheDaemonSearch('targets', 'sessions').
+     * This will have sinon stub out each call so the first call to search will
+     * provide all the models from the first parameter you specify,
+     * the second call will provide all the models from the second argument, etc.
+     * @param types
+     */
+    this.stubCacheDaemonSearch = (...types) => {
+      stubTypes = types;
+
+      types.forEach((type, i) => {
+        this.searchCacheDaemonStub.onCall(i).callsFake(() => {
+          let models;
+          let resourceName;
+          if (typeOf(type) === 'object') {
+            models = type.func();
+            resourceName = type.resource;
+          } else {
+            models = this.server.schema[type].all().models;
+            resourceName = type;
+          }
+
+          return {
+            [underscore(resourceNames[singularize(resourceName)])]: models.map(
+              (model) => {
+                // Use internal serializer to serialize the model correctly
+                // according to our mirage serializers
+                const modelData =
+                  this.server.serializerOrRegistry.serialize(model);
+
+                // Serialize the data properly to standard JSON as that is what
+                // we're expecting from the cache daemon response
+                return JSON.parse(JSON.stringify(modelData));
+              },
+            ),
+          };
+        });
+      });
+    };
+  });
+
+  hooks.afterEach(function () {
+    // Verify the number of mocks we set up match with how
+    // many times the cache daemon was called with
+    sinon.assert.callCount(this.searchCacheDaemonStub, stubTypes.length);
+
+    stubTypes.forEach((type, i) => {
+      // Assert that the stub was called with the resource we're trying to mock
+      // so we don't mistakenly mock the wrong resource
+      const call = this.searchCacheDaemonStub.getCall(i);
+      let resource = type;
+      if (typeOf(type) === 'object') {
+        resource = type.resource;
+      }
+
+      const mappedResourceName = resourceNames[singularize(resource)];
+      sinon.assert.match(call.args[0], { resource: mappedResourceName });
+    });
+
+    sinon.restore();
+  });
+}

addons/api/addon-test-support/helpers/create-mirage-helper.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { settled } from '@ember/test-helpers';
+
+export function createSetupMirage(startMirage) {
+  return function setupMirage(hooks) {
+    hooks.beforeEach(function () {
+      if (!this.owner) {
+        throw new Error(
+          'Must call one of the ember-qunit setupTest() / setupRenderingTest() / setupApplicationTest() first',
+        );
+      }
+
+      // the environment property here is configuration to the mirage server:
+      // https://github.com/miragejs/miragejs/blob/7ff4f3f6fe56bf0cb1648f5af3f5210fcb07e20b/types/index.d.ts#L383
+      // It is not related to ember's build environment. In this case for mirage the "test" environment does
+      // not load the default scenario:
+      // https://github.com/miragejs/miragejs/blob/7ff4f3f6fe56bf0cb1648f5af3f5210fcb07e20b/lib/server.js#L302
+      this.server = startMirage({ environment: 'test' });
+    });
+
+    hooks.afterEach(function () {
+      return settled().then(() => {
+        if (this.server) {
+          this.server.shutdown();
+          delete this.server;
+        }
+      });
+    });
+  };
+}

addons/api/addon-test-support/helpers/sqlite.js

@@ -0,0 +1,37 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { v4 as uuidv4 } from 'uuid';
+
+/**
+ * This test helper can help set up and cleanup the database in your tests.
+ *
+ * ```js
+ * import { setupSqlite } from 'api/test-support/helpers/sqlite';
+ *
+ * module('Acceptance | my test', function(hooks) {
+ *  setupApplicationTest(hooks);
+ *  setupSqlite(hooks);
+ *
+ *   // add your actual tests here
+ * });
+ * ```
+ *
+ * @param hooks
+ */
+export function setupSqlite(hooks) {
+  hooks.beforeEach(async function () {
+    const sqliteDb = this.owner.lookup('service:sqlite');
+    await sqliteDb.setup(`test-sqlite-${uuidv4()}`);
+  });
+
+  hooks.afterEach(async function () {
+    const sqliteDb = this.owner.lookup('service:sqlite');
+
+    await sqliteDb.deleteDatabase();
+  });
+}
+
+export default setupSqlite;

addons/api/addon/abilities/account.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/auth-method.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/channel-recording.js

@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 
 /**
  * Provides abilities for channel recordings.
@@ -18,7 +18,7 @@ export default class ChannelRecordingAbility extends ModelAbility {
     const sessionRecording = this.model.connection_recording.session_recording;
     const sessionRecordingAbility = this.abilities.abilityFor(
       'session-recording',
-      sessionRecording
+      sessionRecording,
     );
 
     return this.model.isAsciicast && sessionRecordingAbility.canDownload;

addons/api/addon/abilities/credential-library.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/credential-store.js

@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 /**
  * Provides abilities for credential store.
  */

addons/api/addon/abilities/credential.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/group.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/host-catalog.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/host-set.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/managed-group.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/model.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { Ability } from 'ember-can';

addons/api/addon/abilities/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import ModelAbility from './model';
+import { service } from '@ember/service';
+
+/**
+ * Provides abilities for storage policies.
+ */
+export default class PolicyAbility extends ModelAbility {
+  // =services
+  @service features;
+  // =permissions
+
+  /**
+   * This ensures that storage policies may be read only if the
+   * session-recording feature flag is enabled.
+   */
+  get canRead() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canRead
+      : false;
+  }
+
+  /**
+   * This ensures that storage policies may be updated only if the
+   * session-recording feature flag is enabled.
+   */
+  get canUpdate() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canUpdate
+      : false;
+  }
+
+  /**
+   * This ensures that storage policies may be deleted only if the
+   * session-recording feature flag is enabled.
+   */
+  get canDelete() {
+    return this.features.isEnabled('ssh-session-recording')
+      ? super.canDelete
+      : false;
+  }
+}

addons/api/addon/abilities/role.js

@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 
 class InvalidRolePrincipalTypeError extends Error {
   name = 'InvalidRolePrincipalTypeError';
@@ -16,7 +16,7 @@ class InvalidRolePrincipalTypeError extends Error {
 export default class RoleAbility extends ModelAbility {
   // =services
 
-  @service can;
+  @service abilities;
 
   // =permissions
 
@@ -27,6 +27,13 @@ export default class RoleAbility extends ModelAbility {
     return this.hasAuthorizedAction('set-grants');
   }
 
+  /**
+   * @type {boolean}
+   */
+  get canSetGrantScopes() {
+    return this.hasAuthorizedAction('set-grant-scopes');
+  }
+
   /**
    * @type {boolean}
    */
@@ -52,10 +59,11 @@ export default class RoleAbility extends ModelAbility {
     const type = this.model.constructor.modelName;
     const typeIsValid =
       type === 'user' || type === 'group' || type === 'managed-group';
-    if (!typeIsValid)
+    if (!typeIsValid) {
       throw new InvalidRolePrincipalTypeError(
-        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`
+        `Expected a role principal of type 'user', 'group', or 'managed-group'.  Got '${type}'.`,
       );
-    return this.can.can(`read ${type}`, this.model);
+    }
+    return this.abilities.can(`read ${type}`, this.model);
   }
 }

addons/api/addon/abilities/scope.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for scopes.
+ */
+export default class ScopeAbility extends ModelAbility {
+  // =permissions
+  /**
+   * Permission that checks whether a policy can be attached to a scope
+   * @type {boolean}
+   */
+  get canAttachStoragePolicy() {
+    return this.hasAuthorizedAction('attach-storage-policy');
+  }
+
+  /**
+   * Permission that checks whether a policy can be detached to a scope
+   * @type {boolean}
+   */
+  get canDetachStoragePolicy() {
+    return this.hasAuthorizedAction('detach-storage-policy');
+  }
+}

addons/api/addon/abilities/session-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
@@ -21,7 +21,22 @@ export default class SessionRecordingAbility extends ModelAbility {
     return !this.model.isUnknown && super.canRead;
   }
 
+  /**
+   * Only "known" session recording types may be deleted.
+   * @type {boolean}
+   */
+  get canDelete() {
+    return !this.model.isUnknown && super.canDelete && this.model.isAvailable;
+  }
+
   get canDownload() {
     return this.hasAuthorizedAction('download');
   }
+
+  /* Permission that checks whether a policy can be reapplied to a session recording
+   * @type {boolean}
+   */
+  get canReapplyStoragePolicy() {
+    return this.hasAuthorizedAction('reapply-storage-policy');
+  }
 }

addons/api/addon/abilities/session.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
@@ -14,10 +14,25 @@ export default class SessionAbility extends ModelAbility {
   // =permissions
 
   /**
-   * Only "active" or "pending" sessions may be read.
+   * Only available sessions may be read.
    * @type {boolean}
    */
   get canRead() {
-    return (this.model.isActive || this.model.isPending) && super.canRead;
+    return (
+      this.model.isAvailable &&
+      (this.hasAuthorizedAction('read:self') || super.canRead)
+    );
+  }
+
+  /**
+   * Only available sessions may be canceled.
+   * @type {boolean}
+   */
+  get canCancel() {
+    return (
+      this.model.isAvailable &&
+      (this.hasAuthorizedAction('cancel:self') ||
+        this.hasAuthorizedAction('cancel'))
+    );
   }
 }

addons/api/addon/abilities/storage-bucket.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/target.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
@@ -44,7 +44,8 @@ export default class TargetAbility extends ModelAbility {
    */
   get canAddInjectedApplicationCredentialSources() {
     return (
-      this.model.isSSH && this.hasAuthorizedAction('add-credential-sources')
+      (this.model.isSSH || this.model.isRDP) &&
+      this.hasAuthorizedAction('add-credential-sources')
     );
   }
   /**

addons/api/addon/abilities/user.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';

addons/api/addon/abilities/worker.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ModelAbility from './model';
@@ -17,4 +17,18 @@ export default class WorkerAbility extends ModelAbility {
   get canCreateWorkerLed() {
     return this.hasAuthorizedCollectionAction('create:worker-led');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canSetWorkerTags() {
+    return this.hasAuthorizedAction('set-worker-tags');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveTags() {
+    return this.hasAuthorizedAction('remove-worker-tags');
+  }
 }

addons/api/addon/adapters/application.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import RESTAdapter from '@ember-data/adapter/rest';
@@ -45,7 +45,7 @@ function prenormalizeArrayResponse(response) {
 }
 
 export default class ApplicationAdapter extends RESTAdapter.extend(
-  AdapterBuildURLMixin
+  AdapterBuildURLMixin,
 ) {
   // =attributes
 
@@ -108,22 +108,66 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
 
   /**
    * Intercepts "empty" responses and adds an empty `items` array.
-   * @override
-   * @method findAll
-   * @return {Promise} promise
-   */
-  findAll() {
-    return super.findAll(...arguments).then(prenormalizeArrayResponse);
-  }
-
-  /**
-   * Intercepts "empty" responses and adds an empty `items` array.
+   * This query method now supports pagination by checking the responseType and
+   * passing in the list token if the responseType indicates more data
    * @override
    * @method query
    * @return {Promise} promise
    */
-  query() {
-    return super.query(...arguments).then(prenormalizeArrayResponse);
+  async query(store, schema, query) {
+    const { batchLimit, ...queryObject } = query;
+    let result;
+    let data = [];
+
+    // If the query has a page_size, we skip the pagination logic
+    // and return the initial result. This is being used to determine
+    // if the controller supports pagination
+    if (query.page_size) {
+      result = await super.query(store, schema, query);
+      return prenormalizeArrayResponse(result);
+    }
+
+    // Run this loop as long as the response_type is delta,
+    // which indicates that there are more items in the list
+    // or the batch size has not been reached
+    do {
+      try {
+        result = await super.query(store, schema, queryObject);
+      } catch (e) {
+        // If we hit a rate limit mid-pagination, return whatever
+        // data has been accumulated so far rather than throwing and leaving
+        // the user stuck with nothing to show.
+        // Without a list_token this is the very first request with nothing to
+        // show, so rethrow and let normal error handling apply.
+        if (e?.errors?.[0]?.isRateLimited && queryObject.list_token) {
+          result ??= {};
+          result.items = data;
+          result.response_type = 'complete';
+          result.meta = {
+            ...result.meta,
+            rateLimitWarning: { retryAfter: e.errors[0].retryAfter },
+          };
+          return prenormalizeArrayResponse(result);
+        }
+
+        // For all other errors (or a 429 on the very first request with
+        // no data yet), rethrow so normal error handling applies.
+        throw e;
+      }
+
+      // Add the result items to a data array
+      if (result && result.items) {
+        data.push(...result.items);
+        // Pass in the list token for subsequent calls to fetch the remaining list items
+        queryObject.list_token = result.list_token;
+      }
+    } while (
+      result?.response_type === 'delta' &&
+      (!batchLimit || data.length < batchLimit)
+    );
+
+    result.items = data;
+    return prenormalizeArrayResponse(result);
   }
 
   /**
@@ -147,7 +191,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
   }
 
   /**
-   * Overrides default ajax method by rewritting PUT requests as PATCH.
+   * Overrides default ajax method by rewriting PUT requests as PATCH.
    * PATCH is the request method used by our API for updates.
    *
    * @override
@@ -196,7 +240,10 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
   handleResponse(status, headers, payload, requestData) {
     if (this.isInvalid(status, headers, payload)) {
       const detailedMessage = this.generatedDetailedMessage(...arguments);
-      const transformedPayload = this.transformValidationErrors(payload);
+      const transformedPayload = this.transformValidationErrors(
+        payload,
+        status,
+      );
       return new InvalidError(transformedPayload.errors, detailedMessage);
     }
     return super.handleResponse(status, headers, payload, requestData);
@@ -213,6 +260,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    *   - `403 isForbidden`:  the session is authenticated but does not have
    *                         permission to perform the requested action
    *   - `404 isNotFound`:  the requested resource could not be found
+   *   - `429 isRateLimited`:  the client has exceeded the rate limit
    *   - `500 isServer`:  an internal server error occurred
    *   - `isUnknown`:  an error occurred, but we don't know which or
    *                   we don't distinguish it yet
@@ -224,7 +272,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @param  {Object} payload
    * @return {Array} errors payload
    */
-  normalizeErrorResponse(/*status, headers, payload*/) {
+  normalizeErrorResponse(status, headers /*, payload*/) {
     const errors = super.normalizeErrorResponse(...arguments);
     if (isArray(errors)) {
       errors.forEach((error) => {
@@ -238,6 +286,14 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
           case 404:
             error.isNotFound = true;
             break;
+          case 429:
+            error.isRateLimited = true;
+            // Attach rate-limit metadata from response headers so downstream
+            // error handlers can inform the user when they may retry.
+            error.retryAfter = Number(
+              headers['Retry-After'] ?? headers['retry-after'],
+            );
+            break;
           case 500:
             error.isServer = true;
             break;
@@ -254,26 +310,25 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * error format.
    *
    * @param {object} payload
+   * @param status
    * @return {object}
    */
-  transformValidationErrors(payload) {
+  transformValidationErrors(payload, status) {
     const fieldErrors = get(payload, 'details.request_fields') || [];
     // Normalize the primary error message into "base", which is an error
     // that applies to the whole model instance
     const baseError = {
       isInvalid: true,
-      status: payload.source,
-      code: payload.code,
-      detail: payload.message,
+      status,
+      code: payload?.kind,
+      detail: payload?.message,
       source: { pointer: '/data' },
     };
     // Normalize field-specific errors, if any.
     const errors = fieldErrors.map((error) => ({
       detail: error.description,
       // Going forward, nested attributes will be hoisted.  Thus "attributes."
-      // must be stripped from the error name key.  Until all models are
-      // transitioned away from model fragments, however, both this and the
-      // prior error key mappings are necessary.
+      // must be stripped from the error name key.
       source: {
         pointer: `/data/attributes/${error.name.replace('attributes.', '')}`,
       },
@@ -299,6 +354,6 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @return {String} detailed error message
    */
   generatedDetailedMessage(status, headers, payload /*, requestData*/) {
-    return payload.message;
+    return payload?.message;
   }
 }

addons/api/addon/adapters/host-catalog.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationAdapter from './application';
@@ -23,7 +23,7 @@ export default class HostCatalogAdapter extends ApplicationAdapter {
       try {
         const pluginName = snapshot.attr('plugin')?.name;
         if (pluginName) url = `${url}?plugin_name=${pluginName}`;
-      } catch (e) {
+      } catch {
         // Ignore any adapter errors here
       }
     }

addons/api/addon/adapters/session-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationAdapter from './application';
@@ -23,7 +23,7 @@ export default class SessionRecordingAdapter extends ApplicationAdapter {
     let method;
     try {
       method = snapshot?.adapterOptions?.method;
-    } catch (e) {
+    } catch {
       // Ignore any adapter errors here
     }
     if (method === 'download') {
@@ -55,7 +55,7 @@ export default class SessionRecordingAdapter extends ApplicationAdapter {
       throw this.handleResponse(
         response.status,
         response.headers,
-        await response.text()
+        await response.text(),
       );
     }
   }

addons/api/addon/adapters/storage-bucket.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationAdapter from './application';
@@ -22,7 +22,7 @@ export default class StorageBucketAdapter extends ApplicationAdapter {
     let pluginName;
     try {
       pluginName = snapshot?.attr('plugin')?.name;
-    } catch (e) {
+    } catch {
       // Ignore any adapter errors here
     }
     if (requestType === 'createRecord' && pluginName) {

addons/api/addon/generated/models/account.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/alias.js

@@ -0,0 +1,64 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * Alias contains all fields related to an Alias resource
+ */
+export default class GeneratedAliasModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('string', {
+    description:
+      'This is the value referenced by the user that is resolved to the destination id.',
+  })
+  value;
+
+  @attr('string', {
+    description: 'This is the id of the resource that this Alias points to.',
+  })
+  destination_id;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'This contains a host_id which is the id of the host that the session will be authorized for.',
+  })
+  authorize_session_arguments;
+}

addons/api/addon/generated/models/auth-method.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -158,6 +158,13 @@ export default class GeneratedAuthMethodModel extends BaseModel {
   })
   account_claim_maps;
 
+  @attr('string-array', {
+    for: 'oidc',
+    emptyArrayIfMissing: true,
+    isNestedAttribute: true,
+  })
+  prompts;
+
   // =attributes(ldap)
 
   @attr('boolean', {

addons/api/addon/generated/models/auth-token.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/channel-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -31,7 +31,7 @@ export default class GeneratedChannelRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of this Channel.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Channel started.',

addons/api/addon/generated/models/connection-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -38,7 +38,7 @@ export default class GeneratedConnectionRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of this Connection.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Connection started.',

addons/api/addon/generated/models/credential-library.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -75,6 +75,19 @@ export default class GeneratedCredentialLibraryModel extends BaseModel {
   })
   path;
 
+  @attr('string', {
+    for: 'vault-generic',
+    description: 'It indicates the type of credential the library returns.',
+  })
+  credential_type;
+
+  @attr('object', {
+    for: 'vault-generic',
+    description: 'It indicates the credential mapping overrides.',
+    emptyObjectIfMissing: true,
+  })
+  credential_mapping_overrides;
+
   @attr('string', {
     for: 'vault-ssh-certificate',
     isNestedAttribute: true,

addons/api/addon/generated/models/credential-store.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/credential.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -51,17 +51,17 @@ export default class GeneratedCredentialModel extends BaseModel {
   })
   version;
 
-  // =attributes (username_password, ssh_private_key)
+  // =attributes (username_password, ssh_private_key, username_password_domain)
   @attr('string', {
-    for: ['username_password', 'ssh_private_key'],
+    for: ['username_password', 'ssh_private_key', 'username_password_domain'],
     isNestedAttribute: true,
     description: 'The username for credential.',
   })
   username;
 
-  // =attributes (username_password)
+  // =attributes (username_password, username_password_domain, password)
   @attr('string', {
-    for: 'username_password',
+    for: ['username_password', 'username_password_domain', 'password'],
     isNestedAttribute: true,
     isSecret: true,
     description: 'The password for credential.',
@@ -92,4 +92,12 @@ export default class GeneratedCredentialModel extends BaseModel {
     description: 'The secret associated with credential.',
   })
   json_object;
+
+  // =attributes (username_password_domain)
+  @attr('string', {
+    for: 'username_password_domain',
+    isNestedAttribute: true,
+    description: 'The domain for credential.',
+  })
+  domain;
 }

addons/api/addon/generated/models/group.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/host-catalog.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -55,63 +55,224 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   })
   plugin;
 
-  // AWS & Azure
+  // AWS, Azure & GCP
 
   @attr('boolean', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
     isNestedAttribute: true,
     description: '',
   })
   disable_credential_rotation;
 
+  // AWS and GCP specific
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
+    description:
+      'An expression used to filter the workers that have network access to a service that is hosting the external object store.',
+  })
+  worker_filter;
+
   // AWS specific
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+    },
     isNestedAttribute: true,
     description: '',
   })
   region;
 
+  // AWS static credentials
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'static-credential',
+    },
     isNestedSecret: true,
     description: '',
   })
   access_key_id;
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'static-credential',
+    },
     isNestedSecret: true,
     description: '',
   })
   secret_access_key;
 
+  // AWS dynamic credentials
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role ARN to use.',
+  })
+  role_arn;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role external ID to use.',
+  })
+  role_external_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role session to use.',
+  })
+  role_session_name;
+
+  @attr('object-as-array', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role tags to use.',
+  })
+  role_tags;
+
   // Azure specific
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     isNestedAttribute: true,
     description: '',
   })
   tenant_id;
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     isNestedAttribute: true,
     description: '',
   })
   client_id;
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     isNestedAttribute: true,
     description: '',
   })
   subscription_id;
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     isNestedSecret: true,
     description: '',
   })
   secret_id;
 
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     isNestedSecret: true,
     description: '',
   })
   secret_value;
+
+  // GCP specific
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description: 'The project ID associated with the service account.',
+  })
+  project_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description: 'The deployment area within a region.',
+  })
+  zone;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description:
+      'The email address associated with the service account. The email address used to uniquely identify the service account. It is required for authentication and authorization.',
+  })
+  client_email;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description:
+      'The unique identifier for the service account that will be impersonated.',
+  })
+  target_service_account_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    description:
+      'The ID of the private key used to sign the JWT and authentication.',
+    isNestedSecret: true,
+  })
+  private_key_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    description:
+      'The private key used to sign the JWT and obtain a OAuth 2.0 access token.',
+    isNestedSecret: true,
+  })
+  private_key;
 }

addons/api/addon/generated/models/host-set.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -63,6 +63,10 @@ export default class GeneratedHostSetModel extends BaseModel {
   plugin;
 
   @attr('number', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
     description:
       "The number of seconds between the time boundary syncs the hosts in this set using this host set's plugin. If not provided a system determined default is used",
   })
@@ -79,12 +83,21 @@ export default class GeneratedHostSetModel extends BaseModel {
   host_ids;
 
   @attr('string-array', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
     emptyArrayIfMissing: true,
+    trimWhitespace: true,
   })
   preferred_endpoints;
 
-  // AWS specific
+  // AWS & GCP specific
   @attr('string-array', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'gcp'],
+    },
     isNestedAttribute: true,
     emptyArrayIfMissing: true,
   })
@@ -92,6 +105,10 @@ export default class GeneratedHostSetModel extends BaseModel {
 
   // Azure specific, comes in from API as "filter". This is to avoid collisions with filter
   @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
     description: '',
     isNestedAttribute: true,
   })

addons/api/addon/generated/models/host.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -54,4 +54,10 @@ export default class GeneratedHostModel extends BaseModel {
     readOnly: true,
   })
   plugin;
+
+  @attr({
+    emptyArrayIfMissing: true,
+    readOnly: true,
+  })
+  host_set_ids;
 }

addons/api/addon/generated/models/managed-group.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/policy.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import BaseModel from '../../models/base';
+import { attr } from '@ember-data/model';
+
+/**
+ * Storage Policy is a resource that manages the lifecycle of Session Recordings,
+ * particularly to meet compliance frameworks.
+ */
+export default class GeneratedPolicyModel extends BaseModel {
+  // =attributes
+
+  @attr('string', {
+    description: 'The type of the resource, to help differentiate schemas',
+  })
+  type;
+
+  @attr('string', {
+    description: 'Optional name for identification purposes.',
+  })
+  name;
+
+  @attr('string', {
+    description: 'Optional user-set description for identification purposes.',
+  })
+  description;
+
+  @attr('date', {
+    description: 'The time this resource was created\nOutput only.',
+    readOnly: true,
+  })
+  created_time;
+
+  @attr('date', {
+    description: 'The time this resource was last updated\nOutput only.',
+    readOnly: true,
+  })
+  updated_time;
+
+  @attr('number', {
+    description: 'Current version number of this resource.',
+  })
+  version;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'Days is the number of days for which a session recording will be retained.',
+  })
+  retain_for;
+
+  @attr('object', {
+    isNestedAttribute: true,
+    description:
+      'Days is the number of days for which a session recording will be automatically deleted.',
+  })
+  delete_after;
+}

addons/api/addon/generated/models/role.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -22,11 +22,12 @@ export default class GeneratedRoleModel extends BaseModel {
   })
   description;
 
-  @attr('string', {
+  @attr('array', {
+    emptyArrayIfMissing: true,
     description:
-      "The scope to which this role applies.  Defaults to the role's scope.",
+      "The scopes to which this role applies.  Defaults to the role's scope.",
   })
-  grant_scope_id;
+  grant_scope_ids;
 
   @attr('date', {
     description: 'The time this resource was created\nOutput only.',

addons/api/addon/generated/models/scope.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -49,4 +49,9 @@ export default class GeneratedScopeModel extends BaseModel {
     description: 'Current version number of this resource.',
   })
   version;
+
+  @attr('string', {
+    description: 'The ID of the associated storage policy',
+  })
+  storage_policy_id;
 }

addons/api/addon/generated/models/session-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -70,7 +70,7 @@ export default class GeneratedSessionRecordingModel extends BaseModel {
       'The total number of errors that occurred during the use of the Session.',
     readOnly: true,
   })
-  errors;
+  errors_number;
 
   @attr('date', {
     description: 'The time the Session started.',
@@ -96,6 +96,34 @@ export default class GeneratedSessionRecordingModel extends BaseModel {
   })
   duration;
 
+  @attr({
+    description:
+      'The detailed state of the session recording. This contains storage_state, syncing_error_details, and verification_error_details.',
+    readOnly: true,
+  })
+  recording_state;
+
+  @attr('string', {
+    description:
+      'The availability of the session recording. One of "available" or "not available".',
+    readOnly: true,
+  })
+  availability;
+
+  @attr('date', {
+    description: 'The time until a session recording is required to be stored.',
+    readOnly: true,
+  })
+  retain_until;
+
+  @attr('date', {
+    description:
+      'The time a session recording is scheduled to be automatically deleted.',
+    readOnly: true,
+  })
+  delete_after;
+
+  // Deprecated: These two fields should be removed once support for RDP is added.
   @attr('string', {
     description:
       'The current state of the session recording. One of "started", "available" and "unknown".',

addons/api/addon/generated/models/session.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -32,6 +32,13 @@ export default class GeneratedSessionModel extends BaseModel {
   })
   updated_time;
 
+  @attr('date', {
+    description:
+      'After this time the connection will be expired, e.g. forcefully terminated.\nOutput only.',
+    readOnly: true,
+  })
+  expiration_time;
+
   @attr('number', {
     description: 'Current version number of this resource.',
   })

addons/api/addon/generated/models/storage-bucket.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -70,9 +70,16 @@ export default class GeneratedStorageBucketModel extends BaseModel {
   @attr('string', {
     isNestedAttribute: true,
     description: 'The AWS region to use.',
+    trimWhitespace: true,
   })
   region;
 
+  @attr('string', {
+    isNestedAttribute: true,
+    description: 'The MinIO location server.',
+  })
+  endpoint_url;
+
   //this field is not used in the UI, but this is kept here to replicate the API
   @attr('string', {
     readOnly: true,
@@ -103,6 +110,7 @@ export default class GeneratedStorageBucketModel extends BaseModel {
   @attr('string', {
     isNestedAttribute: true,
     description: 'The role ARN to use.',
+    trimWhitespace: true,
   })
   role_arn;
 

addons/api/addon/generated/models/target.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -38,12 +38,6 @@ export default class GeneratedTargetModel extends BaseModel {
   })
   session_connection_limit;
 
-  @attr('string', {
-    description:
-      'Optional boolean expression to filter the workers that are allowed to satisfy this request.',
-  })
-  worker_filter;
-
   @attr('string', {
     description:
       'Optional boolean expressions to filter the egress workers that are allowed to satisfy this request.',
@@ -108,4 +102,17 @@ export default class GeneratedTargetModel extends BaseModel {
     isNestedAttribute: true,
   })
   enable_session_recording;
+
+  @attr('array', {
+    description:
+      'with_aliases specify the aliases that should be created when the target is created. ',
+  })
+  with_aliases;
+
+  @attr('array', {
+    readOnly: true,
+    description:
+      'with_aliases specify the aliases that should be created when the target is created. ',
+  })
+  aliases;
 }

addons/api/addon/generated/models/user.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';

addons/api/addon/generated/models/worker.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseModel from '../../models/base';
@@ -72,4 +72,27 @@ export default class GeneratedWorkerModel extends BaseModel {
     readOnly: true,
   })
   type;
+
+  @attr({
+    description:
+      'The deduplicated union of the tags reported by the worker ' +
+      'from its configuration and any tags added through other means.\nOutput only.',
+    readOnly: true,
+    emptyObjectIfMissing: true,
+  })
+  canonical_tags;
+
+  @attr({
+    description:
+      "The tags set in the worker's configuration file.\nOutput only.",
+    readOnly: true,
+    emptyObjectIfMissing: true,
+  })
+  config_tags;
+
+  @attr({
+    description: 'The api tags set for the worker.\nOutput only.',
+    emptyObjectIfMissing: true,
+  })
+  api_tags;
 }

addons/api/addon/handlers/cache-daemon-handler.js

@@ -0,0 +1,192 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { service } from '@ember/service';
+import { getOwner, setOwner } from '@ember/application';
+import { generateMQLExpression } from '../utils/mql-query';
+import { paginateResults } from '../utils/paginate-results';
+import { underscore } from '@ember/string';
+
+const { __electronLog } = globalThis;
+
+/**
+ * Not all types are yet supported by the cache daemon so we'll
+ * just whitelist the ones we need to start with. Keys are the resource
+ * types and the values are the fields that are searchable by the client.
+ * @type {{session: string[], alias: string[], target: string[]}}
+ */
+const supportedTypes = {
+  target: ['id', 'name', 'description', 'address', 'scope_id'],
+  session: ['id', 'type', 'status', 'endpoint', 'scope_id', 'target_id'],
+  alias: ['id', 'type', 'value', 'destination_id'],
+};
+
+/**
+ * Map the model resource name to the cache daemon resource name
+ * @type {{session: string, alias: string, target: string}}
+ */
+export const resourceNames = {
+  target: 'targets',
+  session: 'sessions',
+  alias: 'resolvable-aliases',
+};
+
+const fetchControllerData = async (context, next) => {
+  const { data } = context.request;
+  const { query: originalQuery } = data;
+  // remove cache daemon specific query params
+  // eslint-disable-next-line no-unused-vars
+  const { query, page, pageSize, ...remainingQuery } = originalQuery;
+
+  // If we get an error or cache daemon is unavailable, fall back to calling the API
+  context.request.data.query = remainingQuery;
+  const results = await next(context.request);
+
+  // As a result of https://rfcs.emberjs.com/id/0846-ember-data-deprecate-proxies/ we cannot use proxy array methods like .toArray
+  // use slice() instead as indicated in the RFC.
+  const models = results.content.slice();
+
+  const paginatedResult = paginateResults(models, page, pageSize);
+  paginatedResult.meta = { totalItems: models.length };
+  return paginatedResult;
+};
+
+/**
+ * Handler to sit in front of the API request layer
+ * so we can request from the daemon first
+ */
+export default class CacheDaemonHandler {
+  @service session;
+
+  constructor(context) {
+    setOwner(this, getOwner(context));
+  }
+
+  async request(context, next) {
+    switch (context.request.op) {
+      case 'query': {
+        const { store, data } = context.request;
+        const { type, query, options: { pushToStore = true } = {} } = data;
+        const isCacheDaemonRunning =
+          await window.desktop.daemon.isCacheDaemonRunning();
+
+        // eslint-disable-next-line no-unused-vars
+        let { recursive, scope_id, page, pageSize, ...remainingQuery } = query;
+        let searchQuery = '';
+
+        if (
+          !Object.keys(supportedTypes).includes(type) ||
+          !isCacheDaemonRunning
+        ) {
+          return fetchControllerData(context, next);
+        }
+
+        if (remainingQuery.query) {
+          const { search, filters } = remainingQuery.query;
+
+          searchQuery = generateMQLExpression({
+            search: {
+              text: search,
+              fields: supportedTypes[type],
+            },
+            filters,
+          });
+        }
+        const sessionData = this.session.data?.authenticated;
+        const auth_token_id = sessionData?.id;
+        const token = sessionData?.token;
+        const resourceName = resourceNames[type];
+
+        if (remainingQuery.query?.sort) {
+          const { attribute, direction } = remainingQuery.query.sort;
+          if (attribute && direction) {
+            remainingQuery.sort_by = attribute;
+            remainingQuery.sort_direction = direction;
+          }
+        }
+
+        remainingQuery = {
+          ...remainingQuery,
+          query: searchQuery,
+          auth_token_id,
+          token,
+          resource: resourceName,
+        };
+
+        let cacheDaemonResults = {};
+        try {
+          cacheDaemonResults =
+            await window.desktop.daemon.searchCacheDaemon(remainingQuery);
+        } catch (e) {
+          // If we got a 403, most likely the cache daemon was restarted and our token is no longer valid
+          // I'm not sure if we can get a 401 since we always send a token but we'll handle it in the same way
+          if (e.statusCode === 403 || e.statusCode === 401) {
+            try {
+              await window.desktop.daemon.addTokenToDaemons({
+                tokenId: auth_token_id,
+                token,
+              });
+              cacheDaemonResults =
+                await window.desktop.daemon.searchCacheDaemon(remainingQuery);
+            } catch (err) {
+              // If it fails again just fall back to fetching controller data
+              __electronLog?.error(
+                'Failed to add token to daemons',
+                err.message,
+              );
+            }
+          } else {
+            __electronLog?.error(
+              `Failed to search cache daemon for ${resourceName}. Error:`,
+              e.message,
+            );
+
+            return fetchControllerData(context, next);
+          }
+        }
+
+        const results = cacheDaemonResults[underscore(resourceName)];
+        const payload = { items: paginateResults(results, page, pageSize) };
+
+        const schema = store.modelFor(type);
+        const serializer = store.serializerFor(type);
+        const normalizedPayload = serializer.normalizeResponse(
+          store,
+          schema,
+          payload,
+          null,
+          'query',
+        );
+
+        // Return the raw data if we don't push to the store.
+        let records = normalizedPayload.data.map((record) => ({
+          ...record.attributes,
+          id: record.id,
+        }));
+        if (pushToStore) {
+          records = store.push(normalizedPayload);
+        }
+
+        // Set a meta property on the array to store the total items of the results.
+        // This isn't conventional but is better than returning an ArrayProxy
+        // or EmberArray since the ember store query method asserts it has to be an array
+        // so we can't just return an object.
+        // Also include whether the results are incomplete or is still refreshing
+        // as part of the response
+        records.meta = {
+          totalItems: results?.length ?? 0,
+          isLoadIncomplete: cacheDaemonResults.incomplete ?? false,
+          // Sometimes the refresh status returns an error status if it takes too long but it's still refreshing
+          isCacheRefreshing:
+            cacheDaemonResults.refresh_status !== 'not-refreshing',
+        };
+
+        return records;
+      }
+      default:
+        return next(context.request);
+    }
+  }
+}

addons/api/addon/handlers/sqlite-handler.js

@@ -0,0 +1,308 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { getOwner, setOwner } from '@ember/owner';
+import { service } from '@ember/service';
+import { modelMapping } from 'api/services/sqlite';
+import { get } from '@ember/object';
+import { typeOf } from '@ember/utils';
+import { hashCode } from '../utils/hash-code';
+import { generateSQLExpressions } from '../utils/sqlite-query';
+
+const isISODateString = (str) =>
+  typeOf(str) === 'string' &&
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z?$/.test(str);
+
+export default class SqliteHandler {
+  @service sqlite;
+
+  batchLimit = 5_000;
+
+  constructor(context) {
+    setOwner(this, getOwner(context));
+  }
+
+  async request(context, next) {
+    switch (context.request.op) {
+      case 'query': {
+        const { store, data } = context.request;
+        const {
+          type,
+          query,
+          options: {
+            pushToStore = true,
+            peekDb = false,
+            storeToken = true,
+          } = {},
+        } = data;
+        const supportedModels = Object.keys(modelMapping);
+
+        // Go through normal flow if we don't yet support the model
+        // or if we don't have a sqlite db instance
+        if (!supportedModels.includes(type) || !this.sqlite.worker) {
+          return next(context.request);
+        }
+
+        const adapter = store.adapterFor(type);
+        const schema = store.modelFor(type);
+        const serializer = store.serializerFor(type);
+
+        let {
+          page,
+          pageSize,
+          select,
+          query: queryObj,
+          ...remainingQuery
+        } = query;
+        let payload,
+          listToken,
+          writeToDbPromise,
+          totalInsert = 0,
+          rateLimitWarning;
+
+        if (!peekDb) {
+          let tokenKey = `${type}-${hashCode(remainingQuery)}`;
+          // The global token key represents a recursive query from global scope,
+          // which pulls back every resource of this type.
+          const globalTokenKey = `${type}-${hashCode({ scope_id: 'global', recursive: true })}`;
+          if (storeToken) {
+            // Always prefer the global token when it exists for
+            // any more fine-grained query. The global query already fetched every
+            // item for this resource type, so we should just re-use it.
+            if (tokenKey !== globalTokenKey) {
+              const [globalTokenObj] = await this.sqlite.fetchResource({
+                ...generateSQLExpressions('token', {
+                  filters: { id: [{ equals: globalTokenKey }] },
+                }),
+              });
+              if (globalTokenObj?.token) {
+                tokenKey = globalTokenKey;
+                listToken = globalTokenObj.token;
+              }
+            }
+
+            // Only look up the specific token if no global token was found.
+            if (!listToken) {
+              const [tokenObj] = await this.sqlite.fetchResource({
+                ...generateSQLExpressions('token', {
+                  filters: { id: [{ equals: tokenKey }] },
+                }),
+              });
+              listToken = tokenObj?.token;
+            }
+          } else {
+            // This is a temporary fix of clearing the DB (specifically for auth-methods)
+            // since we are not storing the token we do not get back a list of removed_ids
+            // from the API call and we do not want deleted items from showing in list view.
+            await this.sqlite.deleteResource(type);
+          }
+
+          do {
+            try {
+              payload = await adapter.query(store, schema, {
+                ...remainingQuery,
+                list_token: listToken,
+                batchLimit: this.batchLimit,
+              });
+              totalInsert += payload.items?.length ?? 0;
+
+              // Propagate any rate-limit warning the adapter attached
+              if (payload.meta?.rateLimitWarning) {
+                rateLimitWarning = payload.meta.rateLimitWarning;
+              }
+
+              // await the previous writeToDbPromise before writing to db again
+              if (writeToDbPromise) {
+                await writeToDbPromise;
+              }
+            } catch (err) {
+              payload = await this.retryQueryFailure({
+                err,
+                type,
+                adapter,
+                store,
+                schema,
+                remainingQuery,
+              });
+              totalInsert += payload.items?.length ?? 0;
+            }
+            listToken = payload.list_token;
+
+            writeToDbPromise = this.writeToDb(
+              payload,
+              storeToken,
+              tokenKey,
+              pushToStore,
+              serializer,
+              store,
+              schema,
+              type,
+            );
+          } while (payload.response_type === 'delta');
+
+          await writeToDbPromise;
+        }
+
+        if (totalInsert > 0) {
+          // If there were any inserts, let sqlite handle running analyze on the DB
+          await this.sqlite.analyzeDatabase();
+        }
+
+        const { sql, parameters } = generateSQLExpressions(type, queryObj, {
+          page,
+          pageSize,
+          select: select ?? [{ field: 'data' }],
+        });
+
+        const rows = await this.sqlite.fetchResource({
+          sql,
+          parameters,
+        });
+
+        const { sql: countSql, parameters: countParams } =
+          generateSQLExpressions(type, queryObj, {
+            select: [{ field: '*', isCount: true, alias: 'total' }],
+          });
+        const count = await this.sqlite.fetchResource({
+          sql: countSql,
+          parameters: countParams,
+        });
+
+        const results = rows.map((item) =>
+          JSON.parse(item.data, (key, value) =>
+            // Reviver function to convert any ISO strings back to date objects
+            // as we had to initially convert them to strings when stored in SQLite
+            isISODateString(value) ? new Date(value) : value,
+          ),
+        );
+
+        // If we are not pushing to the store, use the raw data with id property
+        const records = pushToStore
+          ? store.push({ data: results })
+          : results.map((record) => ({
+              ...record.attributes,
+              id: record.id,
+            }));
+
+        // Set a meta property on the array to store the total items of the results.
+        // This isn't conventional but is better than returning an ArrayProxy
+        // or EmberArray since the ember store query method asserts it has to be an array
+        // so we can't just return an object.
+        records.meta = {
+          totalItems: count[0].total,
+        };
+
+        if (rateLimitWarning) {
+          records.meta.rateLimitWarning = rateLimitWarning;
+        }
+
+        return records;
+      }
+      default:
+        return next(context.request);
+    }
+  }
+
+  async retryQueryFailure({
+    err,
+    type,
+    adapter,
+    store,
+    schema,
+    remainingQuery,
+  }) {
+    // If we get an invalid list token, we'll delete the token and
+    // clear the DB and try again without a token.
+    if (
+      err?.errors?.[0].status === 400 &&
+      err?.errors?.[0].code === 'invalid list token'
+    ) {
+      await this.sqlite.deleteResource(type);
+      // Delete all tokens of the same resource type so we don't keep clearing the DB.
+      // Even if other tokens may still be valid, we might have cleared data that they
+      // depended on so we should clear all tokens of the same type when clearing the DB.
+      const { sql, parameters } = generateSQLExpressions('token', {
+        filters: { id: [{ contains: type }] },
+      });
+      const tokenRows = await this.sqlite.fetchResource({
+        sql,
+        parameters,
+      });
+      const tokenIds = tokenRows.map((row) => row.id);
+
+      if (tokenIds.length > 0) {
+        await this.sqlite.deleteResource('token', tokenIds);
+      }
+
+      return await adapter.query(store, schema, {
+        ...remainingQuery,
+      });
+    } else {
+      throw err;
+    }
+  }
+
+  async writeToDb(
+    payload,
+    storeToken,
+    tokenKey,
+    pushToStore,
+    serializer,
+    store,
+    schema,
+    type,
+  ) {
+    if (payload.list_token && storeToken) {
+      await this.sqlite.insertResource('token', [
+        [tokenKey, payload.list_token],
+      ]);
+    }
+
+    const normalizedPayload = serializer.normalizeResponse(
+      store,
+      schema,
+      payload,
+      null,
+      'query',
+    );
+
+    const { data: payloadData } = normalizedPayload;
+
+    // Remove any records from the DB if the API indicates they've been deleted
+    // Additionally remove deleted records from ember data store for symmetry
+    if (payload.removed_ids?.length > 0) {
+      await this.sqlite.deleteResource(type, payload.removed_ids);
+
+      if (pushToStore) {
+        payload.removed_ids.forEach((id) => {
+          const record = store.peekRecord(type, id);
+          store.unloadRecord(record);
+        });
+      }
+    }
+
+    // Store the new data we just got back from the API refresh
+    const items = payloadData.map((datum) => {
+      const params = Object.values(modelMapping[type]).map((key) => {
+        let value;
+
+        if (key === 'id') {
+          value = datum.id;
+        } else {
+          value = get(datum, `attributes.${key}`);
+        }
+
+        if (typeOf(value) === 'date') {
+          return value.toISOString();
+        }
+        return value;
+      });
+
+      return [...params, JSON.stringify(datum)];
+    });
+
+    await this.sqlite.insertResource(type, items);
+  }
+}

addons/api/addon/mixins/adapter-build-url.js

@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Mixin from '@ember/object/mixin';
 
 /**
- * Overrides URL-building methods in an adpater for greater flexibility.
+ * Overrides URL-building methods in an adapter for greater flexibility.
  * Specifically enhances calls to `urlPrefix` with `modelName`, `id`, and
  * `snapshot`, which aren't normally passed.  And adds support for a
  * `urlSuffix` method, the return value of which is appended to the end of
@@ -22,7 +22,7 @@ export default Mixin.create({
 
   /**
    * This override behaves identically to the default method by default.
-   * It exists only to document the additional paramters to the method.
+   * It exists only to document the additional parameters to the method.
    * @override
    * @param {string} path
    * @param {string} parentURL

addons/api/addon/models/account.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedAccountModel from '../generated/models/account';
@@ -47,8 +47,8 @@ export default class AccountModel extends GeneratedAccountModel {
    * @type {string}
    */
   get accountName() {
-    const { email, full_name, login_name } = this;
-    return email || full_name || login_name;
+    const { email, full_name, login_name, subject } = this;
+    return email || full_name || login_name || subject;
   }
 
   // =methods
@@ -87,7 +87,7 @@ export default class AccountModel extends GeneratedAccountModel {
   changePassword(
     currentPassword,
     newPassword,
-    options = { adapterOptions: {} }
+    options = { adapterOptions: {} },
   ) {
     const defaultAdapterOptions = {
       method: 'change-password',

addons/api/addon/models/alias.js

@@ -0,0 +1,10 @@
+/**
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import GeneratedAliasModel from '../generated/models/alias';
+
+export const TYPE_ALIAS_TARGET = 'target';
+export const TYPES_ALIAS = Object.freeze([TYPE_ALIAS_TARGET]);
+export default class AliasModel extends GeneratedAliasModel {}

addons/api/addon/models/auth-method.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
@@ -37,6 +37,7 @@ export const options = {
     account_claim_maps: {
       to: ['sub', 'name', 'email'],
     },
+    prompts: ['consent', 'select_account', 'login'],
   },
   ldap: {
     account_attribute_maps: {

addons/api/addon/models/auth-token.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedAuthTokenModel from '../generated/models/auth-token';

addons/api/addon/models/base.js

@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model from '@ember-data/model';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 
 /**
  * Base model class provides common functionality for all models.

addons/api/addon/models/channel-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedChannelRecordingModel from '../generated/models/channel-recording';

addons/api/addon/models/connection-recording.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedConnectionRecordingModel from '../generated/models/connection-recording';

addons/api/addon/models/credential-library.js

@@ -1,21 +1,47 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedCredentialLibraryModel from '../generated/models/credential-library';
-
+import {
+  TYPE_CREDENTIAL_SSH_PRIVATE_KEY,
+  TYPE_CREDENTIAL_USERNAME_PASSWORD_DOMAIN,
+  TYPE_CREDENTIAL_USERNAME_PASSWORD,
+  TYPE_CREDENTIAL_PASSWORD,
+} from 'api/models/credential';
 /**
  * Enum options for credential library.
  */
 export const options = {
   http_method: ['GET', 'POST'],
   key_type: ['ed25519', 'ecdsa', 'rsa'],
+  credential_types: [
+    TYPE_CREDENTIAL_SSH_PRIVATE_KEY,
+    TYPE_CREDENTIAL_USERNAME_PASSWORD,
+    TYPE_CREDENTIAL_USERNAME_PASSWORD_DOMAIN,
+    TYPE_CREDENTIAL_PASSWORD,
+  ],
+  mapping_overrides: {
+    username_password: ['username_attribute', 'password_attribute'],
+    ssh_private_key: [
+      'private_key_attribute',
+      'private_key_passphrase_attribute',
+      'username_attribute',
+    ],
+    username_password_domain: [
+      'username_attribute',
+      'password_attribute',
+      'domain_attribute',
+    ],
+    password: ['password_attribute'],
+  },
 };
 
 export const TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC = 'vault-generic';
 export const TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE =
   'vault-ssh-certificate';
+export const TYPE_CREDENTIAL_LIBRARY_VAULT_LDAP = 'vault-ldap';
 
 /**
  * Supported Credential Library types.
@@ -23,6 +49,7 @@ export const TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE =
 export const TYPES_CREDENTIAL_LIBRARY = Object.freeze([
   TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC,
   TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE,
+  TYPE_CREDENTIAL_LIBRARY_VAULT_LDAP,
 ]);
 
 export default class CredentialLibraryModel extends GeneratedCredentialLibraryModel {
@@ -43,7 +70,8 @@ export default class CredentialLibraryModel extends GeneratedCredentialLibraryMo
   get isVault() {
     return (
       this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC ||
-      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE ||
+      this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_LDAP
     );
   }
 
@@ -62,4 +90,12 @@ export default class CredentialLibraryModel extends GeneratedCredentialLibraryMo
   get isVaultSSHCertificate() {
     return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE;
   }
+
+  /**
+   * True if credential is a vault ldap type.
+   * @type {boolean}
+   */
+  get isVaultLDAP() {
+    return this.type === TYPE_CREDENTIAL_LIBRARY_VAULT_LDAP;
+  }
 }

addons/api/addon/models/credential-store.js

@@ -1,12 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedCredentialStoreModel from '../generated/models/credential-store';
 import { equal } from '@ember/object/computed';
 
-export const types = ['static', 'vault'];
+export const TYPE_CREDENTIAL_STORE_STATIC = 'static';
+export const TYPE_CREDENTIAL_STORE_VAULT = 'vault';
+
+export const TYPES_CREDENTIAL_STORE = Object.freeze([
+  TYPE_CREDENTIAL_STORE_STATIC,
+  TYPE_CREDENTIAL_STORE_VAULT,
+]);
 
 export default class CredentialStoreModel extends GeneratedCredentialStoreModel {
   // =attributes

addons/api/addon/models/credential.js

@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
+ * Copyright IBM Corp. 2021, 2026
+ * SPDX-License-Identifier: BUSL-1.1
  */
 
 import GeneratedCredentialModel from '../generated/models/credential';
@@ -8,7 +8,21 @@ import GeneratedCredentialModel from '../generated/models/credential';
 /**
  * Supported Credential types.
  */
-export const types = ['username_password', 'ssh_private_key', 'json'];
+
+export const TYPE_CREDENTIAL_USERNAME_PASSWORD = 'username_password';
+export const TYPE_CREDENTIAL_SSH_PRIVATE_KEY = 'ssh_private_key';
+export const TYPE_CREDENTIAL_JSON = 'json';
+export const TYPE_CREDENTIAL_USERNAME_PASSWORD_DOMAIN =
+  'username_password_domain';
+export const TYPE_CREDENTIAL_PASSWORD = 'password';
+
+export const TYPES_CREDENTIAL = Object.freeze([
+  TYPE_CREDENTIAL_USERNAME_PASSWORD,
+  TYPE_CREDENTIAL_SSH_PRIVATE_KEY,
+  TYPE_CREDENTIAL_USERNAME_PASSWORD_DOMAIN,
+  TYPE_CREDENTIAL_JSON,
+  TYPE_CREDENTIAL_PASSWORD,
+]);
 
 export default class CredentialModel extends GeneratedCredentialModel {
   // =attributes
@@ -28,7 +42,7 @@ export default class CredentialModel extends GeneratedCredentialModel {
    * @type {boolean}
    */
   get isJSON() {
-    return this.type === 'json';
+    return this.type === TYPE_CREDENTIAL_JSON;
   }
 
   /**
@@ -36,6 +50,6 @@ export default class CredentialModel extends GeneratedCredentialModel {
    * @type {boolean}
    */
   get isUnknown() {
-    return !types.includes(this.type);
+    return !TYPES_CREDENTIAL.includes(this.type);
   }
 }