fix: 🐛 release date (#2922 )

Icu 16439 enable session recording create storage bucket & index (#2886 )
* test: 💍 update selectors for create-storage-bucket-test ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-16439 * test: 💍 add selectors for enable session recording index test ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-16439 * fix: 🐛 clean up duplicate test selectors ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-16439 * refactor: 💡 move single file use selectors back to file ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-16439
2025-07-09 10:08:40 -07:00 · 2025-07-07 11:47:04 -05:00 · 2025-07-07 09:17:06 -07:00 · 2025-07-03 16:46:22 -04:00 · 2025-07-02 13:06:17 -07:00 · 2025-07-02 10:29:12 -07:00
1445 changed files with 66506 additions and 52745 deletions
@@ -15,5 +15,7 @@ project {
    "**/coverage/**",
    "ui/desktop/electron-app/out/**",
    "ui/desktop/electron-app/ember-dist/**",
+    "**/pnpm-lock.yaml",
+    "**/pnpm-workspace.yaml",
  ]
 }
@@ -11,21 +11,57 @@ assignees: ''

 For questions, the best place to get answers is on our [discussion forum](https://discuss.hashicorp.com/c/boundary), as they will get more visibility from experienced users than the issue tracker.

-Please note: We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue in Boundary, please responsibly disclose by contacting us at security@hashicorp.com. Our PGP key is available at [our security page](https://www.hashicorp.com/security/).
+Please note: We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue in Boundary, please responsibly disclose this by contacting us at security@hashicorp.com. Our PGP key is available on [our security page](https://www.hashicorp.com/security/).
+
+Logging is available on Boundary Desktop Client version >= 2.1.0
+
+Logs are found at:
+
+Linux: ~/.config/Boundary/logs/desktop-client.log
+MacOS: ~/Library/Logs/Boundary/desktop-client.log
+Windows: $env:USERPROFILE\AppData\Roaming\Boundary\logs\desktop-client.log
+
+If requests are taking longer than expected, please change the logging level to DEBUG. This will log the cache daemon request times as well.

 -->

-**Describe the bug**
-A clear and concise description of what the bug is.
+## :bug: Bug Report

-**To Reproduce**
-Steps to reproduce the behavior:
-1. Run `boundary authenticate  ...`
-2. Run `boundary connect ...`
-3. See error
+### **Description**

-**Expected behavior**
-A clear and concise description of what you expected to happen.
+_A clear and concise description of the bug._

-**Additional context**
-Add any other context about the problem here.
+### **Steps to Reproduce**
+
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See the error
+
+## **Expected behavior**
+
+_A clear description of what you expected to happen._
+
+## **Actual behavior**
+
+_A clear description of what actually happened._
+
+## **Screenshots (if applicable)**
+
+_Add screenshots or screen recordings to help explain the issue._
+
+## **Environment**
+
+- **OS and Version:** (e.g., Windows 10 (22H2), macOS (14.7.2))
+- **Architecture:** (e.g., arm64, x86_64)
+- **Browser/Version:** (if applicable)
+- **Desktop Client Version:** (if applicable)
+- **Controller/worker versions:** (if applicable)
+
+## **Logs & Console Output (if applicable)**
+
+_Paste any relevant error logs or browser console output here._
+
+## **Additional Context**
+
+_Any other details that might be relevant._
@@ -0,0 +1,6 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+      interval: "monthly"
@@ -18,3 +18,11 @@
 - [ ] I have commented on my code, particularly in hard-to-understand areas
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
+
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.
@@ -27,7 +27,6 @@ echo "Trying to merge the latest oss commit - ${latest_oss_commit} from oss/${BR
 if ! errors=$(git merge -m "Merge Boundary UI OSS branch '${BRANCH}' at commit ${latest_oss_commit}" "${latest_oss_commit}"); then
  # Here we can try to auto resolve conflicts
  # This logic will vary from project to project. The below is just an example.
-  # We'll try to resolve package.json and yarn.lock conflicts by taking the OSS changes
  conflicts=$(git diff --name-only --diff-filter=U)
  printf "Found conflicts:\n${conflicts}\n"
  # Resolve package.json conflicts by taking oss
@@ -36,11 +35,12 @@ if ! errors=$(git merge -m "Merge Boundary UI OSS branch '${BRANCH}' at commit $
    git checkout --theirs package.json
    git add package.json
  fi
-  # Resolve yarn.lock conflicts by taking oss
-  if echo "$conflicts" | grep -q yarn.lock; then
-    echo "Checking out oss yarn.lock..."
-    git checkout --theirs yarn.lock
-    git add yarn.lock
+  # Resolve pnpm-lock.yaml conflicts by re-running pnpm install:
+  # https://pnpm.io/git#merge-conflicts
+  if echo "$conflicts" | grep -q pnpm-lock.yaml; then
+    echo "Re-running pnpm install to fix conflicts by regenerating pnpm-lock.yaml..."
+    pnpm install
+    git add pnpm-lock.yaml
  fi

  # If we can commit all the changes without conflict, we have resolved everything automatically
@@ -9,91 +9,86 @@ on:
 jobs:
  dependencies:
    name: Install dependencies
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: "**/node_modules"
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+          run_install: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn install
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --frozen-lockfile
  build-admin-ui-oss:
    name: Build Admin UI OSS
    needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: "**/node_modules"
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+          run_install: false
      - name: Build
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn run build:ui:admin:oss
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:oss
      - name: Upload artifact admin-ui
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: admin-ui
          path: ./ui/admin/dist/
      - name: Upload artifact OSS admin UI
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: admin-ui-oss
          path: ./ui/admin/dist/
  build-admin-ui-enterprise:
    name: Build Admin UI Enterprise
    needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: "**/node_modules"
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+          run_install: false
      - name: Build
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn run build:ui:admin:enterprise
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:enterprise
      - name: Upload artifact enterprise admin UI
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: admin-ui-ent
          path: ./ui/admin/dist/
  build-admin-ui-hcp:
    name: Build Admin UI HCP
    needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: "**/node_modules"
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
+          run_install: false
      - name: Build
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn run build:ui:admin:hcp
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run build:ui:admin:hcp
      - name: Upload artifact HCP admin UI
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: admin-ui-hcp
          path: ./ui/admin/dist/
@@ -1,34 +0,0 @@
-name: "Trigger Build Artifacts for Testing"
-
-on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
-        required: true
-      product_version:
-        required: true
-        type: string
-        description: The version number belonging to the oss binary to be used
-      commit:
-        required: true
-        type: string
-        description: The git SHA of the oss artifacts to be used
-
-jobs:
-  trigger-gha-build-artifacts-for-testing:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Release description
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "Triggering Build Artifacts for Testing using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
-      - name: Trigger Build Artifacts for Testing in boundary-ui-releases
-        run: |
-          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
-          gh workflow run build-artifacts-for-testing.yml \
-          --repo hashicorp/boundary-ui-releases \
-          --ref main \
-          -f TAG="${{ inputs.branch }}" \
-          -f PRODUCT_VERSION="${{ inputs.product_version }}" \
-          -f COMMIT="${{ inputs.commit }}" \
@@ -17,7 +17,7 @@ on:
 jobs:
  analyze:
    name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}

    strategy:
      fail-fast: false
@@ -27,18 +27,18 @@ jobs:
        language: ['javascript']
        # Learn more...
        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
-    
+
    steps:
    - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@8f1a6fed33af5212fab8a999d004627ae8901d1b # codeql-bundle-v2.17.5
+      uses: github/codeql-action/init@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
+        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

@@ -54,4 +54,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8f1a6fed33af5212fab8a999d004627ae8901d1b # codeql-bundle-v2.17.5
+      uses: github/codeql-action/analyze@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7
@@ -1,10 +1,15 @@
-name: Check Copyright Headers
+name: Add Copyright Headers
 on: pull_request
 jobs:
  copywrite:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    permissions:
+      contents: write
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: hashicorp/setup-copywrite@32638da2d4e81d56a0764aa1547882fc4d209636 # v1.1.3
-      - name: Check Header Compliance
-        run: copywrite headers --plan
+      - name: Add missing Copyright Headers
+        run: copywrite headers
+      - uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
+        with:
+          commit_message: Add missing copyright headers
@@ -11,7 +11,7 @@ name: Jira Sync

 jobs:
  sync:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    name: Jira sync
    steps:
    - name: Check if community user
@@ -4,7 +4,7 @@ on:

 jobs:
  triage:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
      with:
@@ -4,71 +4,71 @@ jobs:

  dependencies:
    name: Install dependencies
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+          run_install: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn install
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --frozen-lockfile

  compliance:
    name: License Compliance
    needs: [dependencies]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+          run_install: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn run compliance:licenses
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm run compliance:licenses

  lint:
    name: Lint
    needs: [dependencies, compliance]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            node-modules-
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+          run_install: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn lint
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm lint

  test:
    name: Test
    needs: [lint]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    timeout-minutes: 15
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        id: node-modules-cache
+      - uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1.7.3
        with:
-          path: '**/node_modules'
-          key: node-modules-${{ hashFiles('**/yarn.lock') }}
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+          install-dependencies: true
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
+        with:
+          run_install: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
-      - run: yarn test
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
+      - run: pnpm install --offline
+      - run: pnpm test
@@ -10,7 +10,7 @@ jobs:
  trigger-oss-merge:
    # Run this only on merge events in OSS repo
    if: ${{ github.event.pull_request.merged && github.repository == 'hashicorp/boundary-ui' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
      - name: Trigger Merge
        env:
@@ -4,10 +4,10 @@ on:
    types: [ oss-merge ]
 jobs:
  oss-merge:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
      - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
      - run: |
@@ -0,0 +1,115 @@
+name: Test E2E Desktop Client
+
+on:
+  pull_request:
+    types: [labeled, opened, synchronize, reopened]
+  workflow_dispatch:
+
+jobs:
+  test:
+    if: ${{contains(github.event.pull_request.labels.*.name, 'desktop')}}
+    name: Run Desktop E2E Tests
+    runs-on: ubuntu-22.04
+    env:
+      ENOS_VAR_boundary_edition: "ent"
+      ENOS_VAR_e2e_debug_no_run: true
+      ENOS_VAR_boundary_license_path: "./license.hclic"
+      SETUP_CLI: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
+        with:
+          run_install: false
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            ui/desktop/electron-app/pnpm-lock.yaml
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+
+      - name: Set up Enos
+        uses: hashicorp/action-setup-enos@b9fa53484a1e8fdcc7b02a118bcf01d65b9414c9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Vault CLI
+        run: |
+          wget https://releases.hashicorp.com/vault/1.12.2/vault_1.12.2_linux_amd64.zip -O /tmp/vault.zip
+          unzip /tmp/vault.zip -d /usr/local/bin
+
+      - name: Checkout boundary-enterprise
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: hashicorp/boundary-enterprise
+          #          ref: ${{ github.event.inputs.boundary-enterprise-branch }}
+          path: support/src/boundary-enterprise
+          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+
+      - name: GH fix for localhost resolution
+        run: |
+          cat /etc/hosts && echo "-----------"
+          sudo sed -i 's/::1 *localhost ip6-localhost ip6-loopback/::1 ip6 -localhost ip6-loopback/g' /etc/hosts
+          cat /etc/hosts
+          ssh -V
+
+          echo "127.0.0.1 localhost boundary" | sudo tee -a /etc/hosts
+          echo "127.0.0.1 localhost worker" | sudo tee -a /etc/hosts
+          echo "127.0.0.1 localhost vault" | sudo tee -a /etc/hosts
+
+      # TODO: Build image ourselves in case we don't want to use latest?
+      - name: Get Boundary docker image
+        run: |
+          docker pull hashicorp/boundary-enterprise:latest
+          docker save hashicorp/boundary-enterprise:latest | gzip > /tmp/boundary-enterprise.zip
+
+        # TODO: Set up license in a better way? Use directly rather than writing to file and pull from secrets manager
+      - name: Set up test infra
+        id: infra
+        run: |
+          echo "${{ secrets.BOUNDARY_ENT_LICENSE }}" > ./support/src/boundary-enterprise/enos/license.hclic
+          ssh-keygen -N '' -t ed25519 -f ~/.ssh/github_enos
+          mkdir -p ./enos/terraform-plugin-cache
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          export ENOS_VAR_boundary_docker_image_name=hashicorp/boundary-enterprise:latest && \
+          export ENOS_VAR_boundary_docker_image_file=/tmp/boundary-enterprise.zip && \
+          enos scenario launch --timeout 60m0s --chdir ./support/src/boundary-enterprise/enos e2e_ui_docker_ent builder:crt
+
+      - name: Install dependencies
+        run: |
+          pnpm install --frozen-lockfile
+          cd e2e-tests
+          pnpm playwright install --with-deps
+
+        # Runner is headless so we need to enable a display to run the client
+      - name: Run Tests
+        run: |
+          source <(bash ./support/src/boundary-enterprise/enos/scripts/test_e2e_env.sh)
+          cd e2e-tests
+          export DISPLAY=:99
+          sudo Xvfb -ac :99 -screen 0 1280x1024x24 > /dev/null 2>&1 &
+          pnpm run desktop
+
+      - name: Upload Playwright report
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: playwright-report
+          path: e2e-tests/playwright-report
+
+      - name: Clean up test infra
+        if: ${{ always() }}
+        run: |
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
+          enos scenario destroy --timeout 60m0s --chdir ./support/src/boundary-enterprise/enos e2e_ui_docker_ent builder:crt
@@ -1,25 +0,0 @@
-name: "Trigger Test Boundary UI release"
-
-on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: Please use tag-like format n.n.n-someword (1.111.11-beta)
-        required: true
-
-jobs:
-  trigger-gha-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Release description
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "Triggering Test release using BRANCH and TEST_TAG ${{ github.event.inputs.branch }}"
-      - name: Trigger Release workflow in boundary-ui-releases
-        run: |
-          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
-          gh workflow run release.yml \
-          --repo hashicorp/boundary-ui-releases \
-          --ref main \
-          -f TAG="${{ github.event.inputs.branch }}"
-
@@ -1,4 +1,4 @@
-name: "Trigger Boundary UI release"
+name: "Trigger Boundary Desktop release"

 on:
  push:
@@ -7,16 +7,16 @@ on:

 jobs:
  trigger-gha-release:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Release description
        run: |
          echo "Triggering release with a TAG ${GITHUB_REF#refs/tags/}"
-      - name: Trigger Release workflow in boundary-ui-releases
+      - name: Trigger Release workflow in boundary-desktop-releases
        run: |
          export GITHUB_TOKEN="${{ secrets.ELEVATED_GITHUB_TOKEN }}"
          gh workflow run release.yml \
-          --repo hashicorp/boundary-ui-releases \
+          --repo hashicorp/boundary-desktop-releases \
          --ref main \
          -f TAG="${GITHUB_REF#refs/tags/}"
@@ -19,7 +19,6 @@ coverage-*
 libpeerconnection.log
 npm-debug.log*
 testem.log
-yarn-error.log
 .watchman-cookie*

 ### VisualStudioCode ###
@@ -1,5 +1,2 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-yarn compliance:licenses
-npx lint-staged
+pnpm compliance:licenses
+pnpm lint-staged
@@ -1,6 +1,3 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
 COMMIT_MSG_FILE=$1
 COMMIT_SOURCE=$2
 SHA1=$3
@@ -24,4 +21,3 @@ else
  # This is to allow interaction with the terminal for commitizen
  exec < /dev/tty && npx git-cz --hook || true
 fi
-
@@ -25,7 +25,7 @@ subproject, e.g. running or testing.
  - [Prerequisites](#prerequisites)
  - [Optional Tooling](#optional-tooling)
  - [Installation](#installation)
-  - [Yarn Commands](#yarn-commands)
+  - [Pnpm Commands](#pnpm-commands)
  - [Contributing](#contributing)
    - [Branching](#branching)
    - [Building ToC](#building-toc)
@@ -33,8 +33,8 @@ subproject, e.g. running or testing.
      - [Building with a Container](#building-with-a-container)
    - [Building Desktop UI for Production](#building-desktop-ui-for-production)
    - [Connect Boundary UI to Boundary local instance](#connect-boundary-ui-to-boundary-local-instance)
-      - [For admin](#for-admin)
-      - [For desktop](#for-desktop)
+      - [For Admin](#for-admin)
+      - [For Desktop](#for-desktop)
    - [Committing](#committing)
      - [License Checking](#license-checking)

@@ -67,8 +67,8 @@ You will need the following things properly installed on your computer.

 * [Git][git]
 * [Node.js][node]
-  * Supported versions: `v18` and `v20`.
-* [Yarn][yarn] installed globally
+  * Supported versions: `v20` and `v22`.
+* [Pnpm][pnpm] installed globally
 * [Google Chrome][chrome]
 * [Firefox][firefox]

@@ -90,18 +90,18 @@ that best suit you and your personal style.

 * `git clone <repository-url>` this repository
 * `cd boundary-ui`
-* `yarn install`
+* `pnpm install`

-## Yarn Commands
+## Pnpm Commands

-List of available project commands.  `yarn run <command-name>`
+List of available project commands.  `pnpm run <command-name>`

 | Command             | Description |
 |---------------------|---|
-| build               | Builds Admin UI. |
+| build               | Builds Admin UI for production. |
 | test                | Runs tests in CI mode. |
 | lint                | Runs ember-template-lint on all of the hbs, js, and sass files. |
-| compliance:audit    | Checks for issues using `yarn audit` with moderate and above criticality.|
+| compliance:audit    | Checks for issues using `pnpm audit` with moderate and above criticality.|
 | compliance:licenses | Checks that all dependencies have OSS-compatible licenses. |
 | doc:toc             | Automatically generates a table of contents for the README file. |

@@ -114,20 +114,20 @@ We follow [GitHub Flow][github-flow].
 ### Building ToC

 To autogenerate a ToC (table of contents) for this README,
-run `yarn doc:toc`.  Please update the ToC whenever editing the structure
+run `pnpm doc:toc`.  Please update the ToC whenever editing the structure
 of README.

 ### Building Admin UI for Production

-See ui/admin/README.md Building for Production for more information on how to
-build the Admin UI.  Be sure to set build-related environment variables as
-necessary for your target environment, as described in the Admin UI readme.
+See [Admin UI README](ui/admin/README.md#building-for-production) for more information on how to
+build the Admin UI for production.  Be sure to set build-related environment variables as
+necessary for your target environment, as described in the [Environment Variables](ui/admin/README.md#environment-variables) section of README.

 To quickly produce a production build of Admin UI, run from this folder:

 ```bash
-yarn install
-yarn build
+pnpm install
+pnpm build
 ```

 Assets are saved to `ui/admin/dist/`.
@@ -144,27 +144,27 @@ Assets are saved to `ui/admin/dist/`.

 ### Building Desktop UI for Production

-See ui/desktop/README.md Building for Production for more information on how to
+See [Desktop UI README](ui/desktop/README.md#building-for-production) for more information on how to
 build the Desktop UI.  Be sure to set build-related environment variables as
-necessary for your target environment, as described in the Desktop UI readme.
+necessary for your target environment, as described in the [Environment Variables](ui/desktop/README.md#environment-variables-prod) section of README.

 To quickly produce a production build of Desktop UI, run from this folder:

 ```bash
-yarn install
-yarn build:ui:desktop
+pnpm install
+pnpm build:ui:desktop
 ```

 In windows, UI is generated using docker to provide a stable UI across platforms.

 ```cmd
-yarn install
+pnpm install
 docker-compose -f docker-compose-embedding.yml run build-desktop-production
-yarn build:ui:desktop:app
+pnpm build:ui:desktop:app
 ```

 To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY`
-environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `yarn build:ui:desktop:app`.
+environment variable to set signing certificate name (e.g Developer ID Application: * (*)) when building desktop app using `pnpm build:ui:desktop:app`.

 Assets are saved to `ui/desktop/electron-app/out/make/`.
 DMG packaged desktop UI is available at asset location as `boundary.dmg`.
@@ -174,22 +174,23 @@ EXE archived desktop UI is available at asset location under `zip` folder.

 This describes how to connect local Boundary UI to your local instance of Boundary.

-This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://learn.hashicorp.com/tutorials/boundary/getting-started-dev?in=boundary/getting-started#start-a-dev-environment).
-#### For admin
+This assumes you already have up and running a Boundary dev instance in your local environment with a listener `127.0.0.1:9200` (default behaviour). [Learn how to start a local Boundary dev instance](https://developer.hashicorp.com/boundary/tutorials/get-started-community/community-get-started-dev)
+
+#### For Admin

 This assumes you are within `boundary-ui/ui/admin`.

-You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 yarn start`.
+You will need to turn `off` mirage, tell the UI where to find Boundary and run it: `$ ENABLE_MIRAGE=false API_HOST=http://localhost:9200 pnpm start`.

 Following terminal instructions, open in your browser: `http://localhost:4200/`.

 Once you open the UI you will see the login screen, authenticate using generated admin login name and password.

-#### For desktop
+#### For Desktop

 This assumes you are within `boundary-ui/ui/desktop`.

-You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false yarn start:desktop`.
+You will need to turn `off` mirage and run it: `$ ENABLE_MIRAGE=false pnpm start:desktop`.

 In login screen, authenticate using generated admin login name and password.

@@ -198,7 +199,7 @@ Enter the cluster URL of your Boundary dev instance, by default is: `http://loca
 ### Committing

 We use `husky` and `lint-staged` to ensure linting and other checks pass before a
-commit is completed. Simply do a `yarn install` to make sure the hooks are installed.
+commit is completed. Simply do a `pnpm install` to make sure the hooks are installed.

 Use a normal `git commit` to go through the checks, if you need to skip these checks,
 use `git commit --no-verify` to bypass them. However, a consistent commit message will
@@ -217,10 +218,10 @@ will not be accepted.

 [git]: https://git-scm.com/
 [node]: https://nodejs.org/
-[yarn]: https://classic.yarnpkg.com/lang/en/
+[pnpm]: https://pnpm.io
 [chrome]: https://google.com/chrome/
 [firefox]: https://firefox.com/
-[yarn-workspaces]: https://classic.yarnpkg.com/en/docs/workspaces/
+[pnpm-workspaces]: https://pnpm.io/workspaces
 [homebrew]: https://brew.sh
 [warp]: https://www.warp.dev
 [vscode]: https://code.visualstudio.com/
@@ -12,8 +12,8 @@ insert_final_newline = true
 indent_style = space
 indent_size = 2

-[*.{diff,md}]
-trim_trailing_whitespace = false
-
 [*.hbs]
 insert_final_newline = false
+
+[*.{diff,md}]
+trim_trailing_whitespace = false
@@ -1,12 +1,4 @@
 {
-  /**
-    Ember CLI sends analytics information by default. The data is completely
-    anonymous, but there are times when you might want to disable this behavior.
-
-    Setting `disableAnalytics` to true will prevent any data from being sent.
-  */
-  "disableAnalytics": false,
-
  /**
    Setting `isTypeScriptProject` to true will force the blueprint generators to generate TypeScript
    rather than JavaScript by default, when a TypeScript version of a given blueprint is available.
@@ -1,25 +1,14 @@
 # unconventional js
 /blueprints/*/files/
-/vendor/

 # compiled output
+/declarations/
 /dist/
-/tmp/
-
-# dependencies
-/bower_components/
-/node_modules/

 # misc
 /coverage/
 !.*
 .*/
-.eslintcache

 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
-/package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try
@@ -56,7 +56,7 @@ module.exports = {
      extends: ['plugin:n/recommended'],
    },
    {
-      // Test files:
+      // test files
      files: ['tests/**/*-test.{js,ts}'],
      extends: ['plugin:qunit/recommended'],
      rules: {
@@ -0,0 +1,20 @@
+# compiled output
+/dist/
+/declarations/
+
+# dependencies
+/node_modules/
+
+# misc
+/.env*
+/.pnp*
+/.eslintcache
+/coverage/
+/testem.log
+
+# ember-try
+/.node_modules.ember-try/
+/package.json.ember-try
+
+# broccoli-debug
+/DEBUG/
@@ -2,11 +2,7 @@
 /dist/
 /tmp/

-# dependencies
-/bower_components/
-
 # misc
-/.bowerrc
 /.editorconfig
 /.ember-cli
 /.env*
@@ -19,21 +15,15 @@
 /.prettierignore
 /.prettierrc.js
 /.template-lintrc.js
-/.travis.yml
 /.watchmanconfig
-/bower.json
 /CONTRIBUTING.md
 /ember-cli-build.js
 /testem.js
 /tests/
-/yarn-error.log
-/yarn.lock
+/tsconfig.declarations.json
+/tsconfig.json
 .gitkeep

 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
 /package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try
@@ -1,25 +1,13 @@
 # unconventional js
 /blueprints/*/files/
-/vendor/

 # compiled output
 /dist/
-/tmp/
-
-# dependencies
-/bower_components/
-/node_modules/

 # misc
 /coverage/
 !.*
-.eslintcache
-.lint-todo/
+.*/

 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
-/package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try
@@ -3,6 +3,8 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

+'use strict';
+
 module.exports = {
  overrides: [
    {
@@ -1,3 +1,3 @@
 {
-  "ignore_dirs": ["tmp", "dist"]
+  "ignore_dirs": ["dist"]
 }
@@ -8,7 +8,7 @@ This addon contains the API data access layer for Boundary.

 - [Add API to an App](#add-api-to-an-app)
 - [Installation](#installation)
- [Yarn Commands](#yarn-commands)
+- [Pnpm Commands](#pnpm-commands)
 - [Linting](#linting)
 - [Formatting](#formatting)
 - [Running tests](#running-tests)
@@ -21,7 +21,7 @@ This addon contains the API data access layer for Boundary.
 ## Add API to an App

 Add this addon to an Ember application's `devDependencies` as:
-`"api": "*"`, for applications included in this monorepo.
+`"api": "workspace:*"`, for applications included in this monorepo.

 Since this addon also includes Mirage mocks, be sure to install
 `ember-cli-mirage` and add the following config to your UI project:
@@ -38,9 +38,9 @@ See monorepo README for installation instructions.

 When manually installing addon, ensure `ember-data-fragments@5.0.0-beta.*` is installed to use api models with data fragments.

-## Yarn Commands
+## Pnpm Commands

-List of available project commands.  `yarn run <command-name>`
+List of available project commands.  `pnpm run <command-name>`

 | Command | Description |
 | ------- | ----------- |
@@ -64,28 +64,28 @@ Additional commands in the monorepo package may affect this projects.

 ## Linting

-* `yarn lint:fix`
-* `yarn lint:hbs`
-* `yarn lint:hbs:fix`
-* `yarn lint:js`
-* `yarn lint:js:fix`
+* `pnpm lint:fix`
+* `pnpm lint:hbs`
+* `pnpm lint:hbs:fix`
+* `pnpm lint:js`
+* `pnpm lint:js:fix`

 ## Formatting

 Before submitting your work, be sure to run auto-formatters
 (see commands above).  This helps to ensure consistency among authors.

-* `yarn format`
+* `pnpm format`

 ## Running tests

-* `yarn test` – Runs the test suite on the current Ember version
-* `yarn test --server` – Runs the test suite in "watch mode"
-* `yarn test:all` – Runs the test suite against multiple Ember versions
+* `pnpm test` – Runs the test suite on the current Ember version
+* `pnpm test --server` – Runs the test suite in "watch mode"
+* `pnpm test:all` – Runs the test suite against multiple Ember versions

 ## Running the dummy application

-* `yarn start`
+* `pnpm start`
 * Visit the dummy application at [http://localhost:4200](http://localhost:4200).

 ## Contributing
@@ -95,5 +95,5 @@ See monorepo README for more contribution instructions.
 ### Building ToC

 To autogenerate a ToC (table of contents) for this README,
-run `yarn doc:toc`.  Please update the ToC whenever editing the structure
+run `pnpm doc:toc`.  Please update the ToC whenever editing the structure
 of README.
@@ -7,6 +7,7 @@ import sinon from 'sinon';
 import { typeOf } from '@ember/utils';
 import { resourceNames } from 'api/handlers/cache-daemon-handler';
 import { singularize } from 'ember-inflector';
+import { underscore } from '@ember/string';

 /**
 * This test helper can be used to help setup your sinon stubs in your tests.
@@ -69,16 +70,18 @@ export default function setupStubs(hooks) {
          .withArgs('searchCacheDaemon')
          .onCall(i)
          .returns({
-            [resourceName]: models.map((model) => {
-              // Use internal serializer to serialize the model correctly
-              // according to our mirage serializers
-              const modelData =
-                this.server.serializerOrRegistry.serialize(model);
+            [underscore(resourceNames[singularize(resourceName)])]: models.map(
+              (model) => {
+                // Use internal serializer to serialize the model correctly
+                // according to our mirage serializers
+                const modelData =
+                  this.server.serializerOrRegistry.serialize(model);

-              // Serialize the data properly to standard JSON as that is what
-              // we're expecting from the cache daemon response
-              return JSON.parse(JSON.stringify(modelData));
-            }),
+                // Serialize the data properly to standard JSON as that is what
+                // we're expecting from the cache daemon response
+                return JSON.parse(JSON.stringify(modelData));
+              },
+            ),
          });
      });
    };
@@ -20,9 +20,9 @@
 * @param hooks
 */
 export function setupIndexedDb(hooks) {
-  hooks.beforeEach(function () {
+  hooks.beforeEach(async function () {
    const indexedDb = this.owner.lookup('service:indexed-db');
-    indexedDb.setup(`test-indexed-db-${Date.now()}`);
+    await indexedDb.setup(`test-indexed-db-${Date.now()}`);
  });

  hooks.afterEach(async function () {
@@ -4,7 +4,7 @@
 */

 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 /**
 * Provides abilities for channel recordings.
@@ -4,7 +4,7 @@
 */

 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 /**
 * Provides abilities for credential store.
 */
@@ -4,7 +4,7 @@
 */

 import ModelAbility from './model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 class InvalidRolePrincipalTypeError extends Error {
  name = 'InvalidRolePrincipalTypeError';
@@ -115,7 +115,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
   * @return {Promise} promise
   */
  async query(store, schema, query) {
-    const queryObject = structuredClone(query);
+    const { batchLimit, ...queryObject } = query;
    let result;
    let data = [];

@@ -126,8 +126,10 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
      result = await super.query(store, schema, query);
      return prenormalizeArrayResponse(result);
    }
+
    // Run this loop as long as the response_type is delta,
    // which indicates that there are more items in the list
+    // or the batch size has not been reached
    do {
      result = await super.query(store, schema, queryObject);
      //add the result items to a data array
@@ -136,7 +138,10 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
        //pass in the list token for subsequent calls to fetch the remaining list items
        queryObject.list_token = result.list_token;
      }
-    } while (result && result.response_type === 'delta');
+    } while (
+      result?.response_type === 'delta' &&
+      (!batchLimit || data.length < batchLimit)
+    );

    result.items = data;
    return prenormalizeArrayResponse(result);
@@ -163,7 +168,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
  }

  /**
-   * Overrides default ajax method by rewritting PUT requests as PATCH.
+   * Overrides default ajax method by rewriting PUT requests as PATCH.
   * PATCH is the request method used by our API for updates.
   *
   * @override
@@ -291,9 +296,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    const errors = fieldErrors.map((error) => ({
      detail: error.description,
      // Going forward, nested attributes will be hoisted.  Thus "attributes."
-      // must be stripped from the error name key.  Until all models are
-      // transitioned away from model fragments, however, both this and the
-      // prior error key mappings are necessary.
+      // must be stripped from the error name key.
      source: {
        pointer: `/data/attributes/${error.name.replace('attributes.', '')}`,
      },
@@ -55,63 +55,224 @@ export default class GeneratedHostCatalogModel extends BaseModel {
  })
  plugin;

-  // AWS & Azure
+  // AWS, Azure & GCP

  @attr('boolean', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
    isNestedAttribute: true,
    description: '',
  })
  disable_credential_rotation;

+  // AWS and GCP specific
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'gcp'],
+    },
+    description:
+      'An expression used to filter the workers that have network access to a service that is hosting the external object store.',
+  })
+  worker_filter;
+
  // AWS specific

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+    },
    isNestedAttribute: true,
    description: '',
  })
  region;

+  // AWS static credentials
  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'static-credential',
+    },
    isNestedSecret: true,
    description: '',
  })
  access_key_id;

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'static-credential',
+    },
    isNestedSecret: true,
    description: '',
  })
  secret_access_key;

+  // AWS dynamic credentials
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role ARN to use.',
+  })
+  role_arn;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role external ID to use.',
+  })
+  role_external_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role session to use.',
+  })
+  role_session_name;
+
+  @attr('object-as-array', {
+    for: {
+      type: 'plugin',
+      name: 'aws',
+      credentialType: 'dynamic-credential',
+    },
+    isNestedAttribute: true,
+    description: 'The role tags to use.',
+  })
+  role_tags;
+
  // Azure specific

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    isNestedAttribute: true,
    description: '',
  })
  tenant_id;

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    isNestedAttribute: true,
    description: '',
  })
  client_id;

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    isNestedAttribute: true,
    description: '',
  })
  subscription_id;

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    isNestedSecret: true,
    description: '',
  })
  secret_id;

  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    isNestedSecret: true,
    description: '',
  })
  secret_value;
+
+  // GCP specific
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description: 'The project ID associated with the service account.',
+  })
+  project_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description: 'The deployment area within a region.',
+  })
+  zone;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description:
+      'The email address associated with the service account. The email address used to uniquely identify the service account. It is required for authentication and authorization.',
+  })
+  client_email;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    isNestedAttribute: true,
+    description:
+      'The unique identifier for the service account that will be impersonated.',
+  })
+  target_service_account_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    description:
+      'The ID of the private key used to sign the JWT and authentication.',
+    isNestedSecret: true,
+  })
+  private_key_id;
+
+  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'gcp',
+    },
+    description:
+      'The private key used to sign the JWT and obtain a OAuth 2.0 access token.',
+    isNestedSecret: true,
+  })
+  private_key;
 }
@@ -63,6 +63,10 @@ export default class GeneratedHostSetModel extends BaseModel {
  plugin;

  @attr('number', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
    description:
      "The number of seconds between the time boundary syncs the hosts in this set using this host set's plugin. If not provided a system determined default is used",
  })
@@ -79,12 +83,21 @@ export default class GeneratedHostSetModel extends BaseModel {
  host_ids;

  @attr('string-array', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'azure', 'gcp'],
+    },
    emptyArrayIfMissing: true,
+    trimWhitespace: true,
  })
  preferred_endpoints;

-  // AWS specific
+  // AWS & GCP specific
  @attr('string-array', {
+    for: {
+      type: 'plugin',
+      name: ['aws', 'gcp'],
+    },
    isNestedAttribute: true,
    emptyArrayIfMissing: true,
  })
@@ -92,6 +105,10 @@ export default class GeneratedHostSetModel extends BaseModel {

  // Azure specific, comes in from API as "filter". This is to avoid collisions with filter
  @attr('string', {
+    for: {
+      type: 'plugin',
+      name: 'azure',
+    },
    description: '',
    isNestedAttribute: true,
  })
@@ -70,6 +70,7 @@ export default class GeneratedStorageBucketModel extends BaseModel {
  @attr('string', {
    isNestedAttribute: true,
    description: 'The AWS region to use.',
+    trimWhitespace: true,
  })
  region;

@@ -109,6 +110,7 @@ export default class GeneratedStorageBucketModel extends BaseModel {
  @attr('string', {
    isNestedAttribute: true,
    description: 'The role ARN to use.',
+    trimWhitespace: true,
  })
  role_arn;

@@ -3,11 +3,13 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-/* global __electronLog */
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 import { getOwner, setOwner } from '@ember/application';
 import { generateMQLExpression } from '../utils/mql-query';
 import { paginateResults } from '../utils/paginate-results';
+import { underscore } from '@ember/string';
+
+const { __electronLog } = globalThis;

 /**
 * Not all types are yet supported by the cache daemon so we'll
@@ -41,7 +43,10 @@ const fetchControllerData = async (context, next) => {
  // If we get an error or cache daemon is unavailable, fall back to calling the API
  context.request.data.query = remainingQuery;
  const results = await next(context.request);
-  const models = results.content.toArray();
+
+  // As a result of https://rfcs.emberjs.com/id/0846-ember-data-deprecate-proxies/ we cannot use proxy array methods like .toArray
+  // use slice() instead as indicated in the RFC.
+  const models = results.content.slice();

  const paginatedResult = paginateResults(models, page, pageSize);
  paginatedResult.meta = { totalItems: models.length };
@@ -94,12 +99,14 @@ export default class CacheDaemonHandler {
        const sessionData = this.session.data?.authenticated;
        const auth_token_id = sessionData?.id;
        const token = sessionData?.token;
+        const resourceName = resourceNames[type];
+
        remainingQuery = {
          ...remainingQuery,
          query: searchQuery,
          auth_token_id,
          token,
-          resource: resourceNames[type],
+          resource: resourceName,
        };

        let cacheDaemonResults = {};
@@ -130,7 +137,7 @@ export default class CacheDaemonHandler {
            }
          } else {
            __electronLog?.error(
-              'Failed to search cache daemon; falling back to search controller',
+              `Failed to search cache daemon for ${resourceName}. Error:`,
              e.message,
            );

@@ -138,10 +145,7 @@ export default class CacheDaemonHandler {
          }
        }

-        // Currently returns with a singular top level field with resource name
-        // e.g. { targets: [...] } or { sessions: [..] }
-        // So this just unwraps to the array, or undefined
-        const [results] = Object.values(cacheDaemonResults);
+        const results = cacheDaemonResults[underscore(resourceName)];
        const payload = { items: paginateResults(results, page, pageSize) };

        const schema = store.modelFor(type);
@@ -167,7 +171,16 @@ export default class CacheDaemonHandler {
        // This isn't conventional but is better than returning an ArrayProxy
        // or EmberArray since the ember store query method asserts it has to be an array
        // so we can't just return an object.
-        records.meta = { totalItems: results?.length ?? 0 };
+        // Also include whether the results are incomplete or is still refreshing
+        // as part of the response
+        records.meta = {
+          totalItems: results?.length ?? 0,
+          isLoadIncomplete: cacheDaemonResults.incomplete ?? false,
+          // Sometimes the refresh status returns an error status if it takes too long but it's still refreshing
+          isCacheRefreshing:
+            cacheDaemonResults.refresh_status !== 'not-refreshing',
+        };
+
        return records;
      }
      default:
@@ -4,10 +4,11 @@
 */

 import { modelIndexes } from 'api/services/indexed-db';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
 import { getOwner, setOwner } from '@ember/application';
 import { queryIndexedDb } from '../utils/indexed-db-query';
 import { paginateResults } from '../utils/paginate-results';
+import { sortResults } from '../utils/sort-results';
 import { hashCode } from '../utils/hash-code';

 /**
@@ -17,11 +18,15 @@ import { hashCode } from '../utils/hash-code';
 export default class IndexedDbHandler {
  @service indexedDb;

+  batchLimit = 10_000;
+
  constructor(context) {
    setOwner(this, getOwner(context));
  }

  async request(context, next) {
+    const { batchLimit } = this;
+
    switch (context.request.op) {
      case 'query': {
        const { store, data } = context.request;
@@ -52,111 +57,89 @@ export default class IndexedDbHandler {

        if (!peekIndexedDB) {
          const tokenKey = `${type}-${hashCode(remainingQuery)}`;
-
+          let payload;
          let listToken;
+          let writeToIndexedDbPromise;
+
          if (storeToken) {
-            listToken = await indexedDb.token.get(tokenKey);
+            const tokenObj = await indexedDb.token.get(tokenKey);
+            listToken = tokenObj?.token;
          }

-          let payload;
-          try {
-            payload = await adapter.query(store, schema, {
-              ...remainingQuery,
-              list_token: listToken?.token,
-            });
-          } catch (e) {
-            // If we get an invalid list token, we'll delete the token and
-            // clear the DB and try again without a token.
-            if (
-              e?.errors[0].status === 400 &&
-              e?.errors[0].code === 'invalid list token'
-            ) {
-              await indexedDb[type].clear();
-              // Delete all tokens of the same resource type so we don't keep clearing the DB.
-              // Even if other tokens may still be valid, we might have cleared data that they
-              // depended on so we should clear all tokens of the same type when clearing the DB.
-              const tokenKeys = await indexedDb.token
-                .where(':id')
-                .startsWith(type)
-                .primaryKeys();
-
-              await indexedDb.token.bulkDelete(tokenKeys);
-
+          do {
+            try {
              payload = await adapter.query(store, schema, {
                ...remainingQuery,
+                list_token: listToken,
+                batchLimit: batchLimit,
+              });
+
+              // await the previous writeToIndexedDbPromise before writing to indexedDb again
+              if (writeToIndexedDbPromise) {
+                await writeToIndexedDbPromise;
+              }
+            } catch (err) {
+              payload = await this.retryQueryFailure({
+                err,
+                indexedDb,
+                type,
+                adapter,
+                store,
+                schema,
+                remainingQuery,
              });
-            } else {
-              throw e;
            }
-          }
+            listToken = payload.list_token;

-          // Store the token we just got back from the payload if it exists
-          if (payload.list_token && storeToken) {
-            await indexedDb.token.put({
-              id: tokenKey,
-              token: payload.list_token,
-            });
-          }
-
-          // Remove any records from the DB if the API indicates they've been deleted
-          if (payload.removed_ids?.length > 0) {
-            await indexedDb[type].bulkDelete(payload.removed_ids);
-          }
-          // This is a temporary fix of clearing the DB (specifically for auth-methods)
-          // since we are not storing the token we do not get back a list of removed_ids
-          // from the API call and we do not want deleted items from showing in list view.
-          if (!storeToken) {
-            await indexedDb[type].clear();
-          }
-
-          const normalizedPayload = serializer.normalizeResponse(
-            store,
-            schema,
-            payload,
-            null,
-            'query',
-          );
-
-          const { data: payloadData } = normalizedPayload;
-
-          // Store the new data we just got back from the API refresh
-          const items = payloadData.map((datum) =>
-            this.indexedDb.normalizeData({
-              data: datum,
-              cleanData: true,
-              schema,
+            // Don't await immediately and let the next query run while we write to indexedDb
+            writeToIndexedDbPromise = this.writeToIndexedDb({
+              payload,
+              storeToken,
+              indexedDb,
+              tokenKey,
+              type,
              serializer,
-            }),
-          );
+              store,
+              schema,
+            });
+          } while (payload.response_type === 'delta');

-          await indexedDb[type].bulkPut(items);
+          await writeToIndexedDbPromise;
        }

+        // Results returned in JSON API reponse, but in a format optimized for indexedDb
        const indexedDbResults = await queryIndexedDb(
          indexedDb,
          type,
          queryObj,
        );

-        const dbRecords = paginateResults(indexedDbResults, page, pageSize).map(
-          (item) =>
-            this.indexedDb.normalizeData({
-              data: item,
-              cleanData: false,
-              schema,
-              serializer,
-            }),
-        );
+        // Normalize the results and clean up indexedDb format, ready for ember data consumption
+        const normalizedResults = indexedDbResults.map((item) => {
+          return this.indexedDb.normalizeData({
+            data: item,
+            cleanData: false,
+            schema,
+            serializer,
+          });
+        });

-        // Return the raw data if we don't push to the store.
-        let records = dbRecords.map((record) => ({
-          ...record.attributes,
-          id: record.id,
-        }));
+        // Sort the results
+        const sortedResults = sortResults(normalizedResults, {
+          querySort: queryObj?.sort,
+          schema,
+        });

-        if (pushToStore) {
-          records = store.push({ data: dbRecords });
-        }
+        // Paginate the results
+        const paginatedResults = paginateResults(sortedResults, page, pageSize);
+
+        // If we are not pushing to the store, use the raw data with id property
+        const records = pushToStore
+          ? store.push({ data: paginatedResults })
+          : paginatedResults.map((record) => ({
+              ...record.attributes,
+              id: record.id,
+            }));

        // Set a meta property on the array to store the total items of the results.
        // This isn't conventional but is better than returning an ArrayProxy
@@ -169,4 +152,91 @@ export default class IndexedDbHandler {
        return next(context.request);
    }
  }
+
+  async retryQueryFailure({
+    err,
+    indexedDb,
+    type,
+    adapter,
+    store,
+    schema,
+    remainingQuery,
+  }) {
+    // If we get an invalid list token, we'll delete the token and
+    // clear the DB and try again without a token.
+    if (
+      err?.errors[0].status === 400 &&
+      err?.errors[0].code === 'invalid list token'
+    ) {
+      await indexedDb[type].clear();
+      // Delete all tokens of the same resource type so we don't keep clearing the DB.
+      // Even if other tokens may still be valid, we might have cleared data that they
+      // depended on so we should clear all tokens of the same type when clearing the DB.
+      const tokenKeys = await indexedDb.token
+        .where(':id')
+        .startsWith(type)
+        .primaryKeys();
+
+      await indexedDb.token.bulkDelete(tokenKeys);
+
+      return await adapter.query(store, schema, {
+        ...remainingQuery,
+      });
+    } else {
+      throw err;
+    }
+  }
+
+  async writeToIndexedDb({
+    payload,
+    storeToken,
+    indexedDb,
+    tokenKey,
+    type,
+    serializer,
+    store,
+    schema,
+  }) {
+    // Store the token we just got back from the payload if it exists
+    if (payload.list_token && storeToken) {
+      await indexedDb.token.put({
+        id: tokenKey,
+        token: payload.list_token,
+      });
+    }
+
+    // Remove any records from the DB if the API indicates they've been deleted
+    if (payload.removed_ids?.length > 0) {
+      await indexedDb[type].bulkDelete(payload.removed_ids);
+    }
+
+    // This is a temporary fix of clearing the DB (specifically for auth-methods)
+    // since we are not storing the token we do not get back a list of removed_ids
+    // from the API call and we do not want deleted items from showing in list view.
+    if (!storeToken) {
+      await indexedDb[type].clear();
+    }
+
+    const normalizedPayload = serializer.normalizeResponse(
+      store,
+      schema,
+      payload,
+      null,
+      'query',
+    );
+
+    const { data: payloadData } = normalizedPayload;
+
+    // Store the new data we just got back from the API refresh
+    const items = payloadData.map((datum) =>
+      this.indexedDb.normalizeData({
+        data: datum,
+        cleanData: true,
+        schema,
+        serializer,
+      }),
+    );
+
+    await indexedDb[type].bulkPut(items);
+  }
 }
@@ -1,27 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { registerDeprecationHandler } from '@ember/debug';
-
-const deprecationList = ['ember-data:deprecate-early-static'];
-
-export function initialize() {
-  registerDeprecationHandler((message, options, next) => {
-    // TODO: Remove deprecation handling for `deprecate-early-static` warning
-    // once we upgrade to ember-cli-mirage v3.0.0 which fixes this issue.
-    // More info about this issue here: https://github.com/miragejs/ember-cli-mirage/issues/2441
-    if (options?.id && deprecationList.includes(options.id)) {
-      return;
-    }
-    if (options?.url) {
-      message += options.url;
-    }
-    next(message, options);
-  });
-}
-
-export default {
-  initialize,
-};
@@ -6,7 +6,7 @@
 import Mixin from '@ember/object/mixin';

 /**
- * Overrides URL-building methods in an adpater for greater flexibility.
+ * Overrides URL-building methods in an adapter for greater flexibility.
 * Specifically enhances calls to `urlPrefix` with `modelName`, `id`, and
 * `snapshot`, which aren't normally passed.  And adds support for a
 * `urlSuffix` method, the return value of which is appended to the end of
@@ -22,7 +22,7 @@ export default Mixin.create({

  /**
   * This override behaves identically to the default method by default.
-   * It exists only to document the additional paramters to the method.
+   * It exists only to document the additional parameters to the method.
   * @override
   * @param {string} path
   * @param {string} parentURL
@@ -47,8 +47,8 @@ export default class AccountModel extends GeneratedAccountModel {
   * @type {string}
   */
  get accountName() {
-    const { email, full_name, login_name } = this;
-    return email || full_name || login_name;
+    const { email, full_name, login_name, subject } = this;
+    return email || full_name || login_name || subject;
  }

  // =methods
@@ -6,7 +6,7 @@
 import Model from '@ember-data/model';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 /**
 * Base model class provides common functionality for all models.
@@ -8,7 +8,16 @@ import GeneratedCredentialModel from '../generated/models/credential';
 /**
 * Supported Credential types.
 */
-export const types = ['username_password', 'ssh_private_key', 'json'];
+
+export const TYPE_CREDENTIAL_USERNAME_PASSWORD = 'username_password';
+export const TYPE_CREDENTIAL_SSH_PRIVATE_KEY = 'ssh_private_key';
+export const TYPE_CREDENTIAL_JSON = 'json';
+
+export const TYPES_CREDENTIAL = Object.freeze([
+  TYPE_CREDENTIAL_USERNAME_PASSWORD,
+  TYPE_CREDENTIAL_SSH_PRIVATE_KEY,
+  TYPE_CREDENTIAL_JSON,
+]);

 export default class CredentialModel extends GeneratedCredentialModel {
  // =attributes
@@ -28,7 +37,7 @@ export default class CredentialModel extends GeneratedCredentialModel {
   * @type {boolean}
   */
  get isJSON() {
-    return this.type === 'json';
+    return this.type === TYPE_CREDENTIAL_JSON;
  }

  /**
@@ -36,6 +45,6 @@ export default class CredentialModel extends GeneratedCredentialModel {
   * @type {boolean}
   */
  get isUnknown() {
-    return !types.includes(this.type);
+    return !TYPES_CREDENTIAL.includes(this.type);
  }
 }
@@ -7,7 +7,7 @@ import GeneratedGroupModel from '../generated/models/group';
 import { attr } from '@ember-data/model';
 import { computed } from '@ember/object';
 import { A } from '@ember/array';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 export default class GroupModel extends GeneratedGroupModel {
  // =services
@@ -4,6 +4,7 @@
 */

 import GeneratedHostCatalogModel from '../generated/models/host-catalog';
+import { tracked } from '@glimmer/tracking';

 export const TYPE_HOST_CATALOG_STATIC = 'static';
 export const TYPE_HOST_CATALOG_DYNAMIC = 'plugin';
@@ -14,14 +15,34 @@ export const TYPES_HOST_CATALOG = Object.freeze([

 export const TYPE_HOST_CATALOG_PLUGIN_AWS = 'aws';
 export const TYPE_HOST_CATALOG_PLUGIN_AZURE = 'azure';
+export const TYPE_HOST_CATALOG_PLUGIN_GCP = 'gcp';
 export const TYPES_HOST_CATALOG_PLUGIN = [
  TYPE_HOST_CATALOG_PLUGIN_AWS,
  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+  TYPE_HOST_CATALOG_PLUGIN_GCP,
 ];

+export const TYPE_CREDENTIAL_STATIC = 'static-credential';
+export const TYPE_CREDENTIAL_DYNAMIC = 'dynamic-credential';
+
+export const TYPES_CREDENTIALS = Object.freeze([
+  TYPE_CREDENTIAL_STATIC,
+  TYPE_CREDENTIAL_DYNAMIC,
+]);
+
+export const DYNAMIC_CREDENTIAL_FIELDS = [
+  'role_arn',
+  'role_external_id',
+  'role_session_name',
+  'role_tags',
+];
+export const STATIC_CREDENTIAL_FIELDS = ['access_key_id, secret_access_key'];
+
 export default class HostCatalogModel extends GeneratedHostCatalogModel {
  // =attributes

+  @tracked _credentialTypeValue;
+
  /**
   * True if the host catalog is static.
   * @type {boolean}
@@ -38,6 +59,29 @@ export default class HostCatalogModel extends GeneratedHostCatalogModel {
    return this.type === 'plugin';
  }

+  /**
+   * Gets a value from credentialType
+   * @type {string}
+   */
+  get credentialType() {
+    if (!this._credentialTypeValue) {
+      if (DYNAMIC_CREDENTIAL_FIELDS.some((field) => this[field])) {
+        return TYPE_CREDENTIAL_DYNAMIC;
+      } else {
+        return TYPE_CREDENTIAL_STATIC;
+      }
+    }
+    return this._credentialTypeValue;
+  }
+
+  /**
+   * Sets a value to credentialType
+   * @type {string}
+   */
+  set credentialType(type) {
+    this._credentialTypeValue = type;
+  }
+
  /**
   * True if the host catalog is an unknown type.
   * @type {boolean}
@@ -53,7 +97,7 @@ export default class HostCatalogModel extends GeneratedHostCatalogModel {
   * @type {boolean}
   */
  get isAWS() {
-    return this.compositeType === 'aws';
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_AWS;
  }

  /**
@@ -61,7 +105,15 @@ export default class HostCatalogModel extends GeneratedHostCatalogModel {
   * @type {boolean}
   */
  get isAzure() {
-    return this.compositeType === 'azure';
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_AZURE;
+  }
+
+  /**
+   * True if host catalog plugin type is GCP.
+   * @type {boolean}
+   */
+  get isGCP() {
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_GCP;
  }

  /**
@@ -4,7 +4,12 @@
 */

 import GeneratedHostSetModel from '../generated/models/host-set';
-import { TYPES_HOST_CATALOG_PLUGIN } from './host-catalog';
+import {
+  TYPES_HOST_CATALOG_PLUGIN,
+  TYPE_HOST_CATALOG_PLUGIN_GCP,
+  TYPE_HOST_CATALOG_PLUGIN_AWS,
+  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+} from './host-catalog';

 export default class HostSetModel extends GeneratedHostSetModel {
  // =attributes
@@ -40,14 +45,22 @@ export default class HostSetModel extends GeneratedHostSetModel {
   * @type {boolean}
   */
  get isAWS() {
-    return this.compositeType === 'aws';
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_AWS;
  }

  /**
   * Return if a host-set plugin is Azure or not.
   */
  get isAzure() {
-    return this.compositeType === 'azure';
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_AZURE;
+  }
+
+  /**
+   * True if host catalog plugin type is GCP.
+   * @type {boolean}
+   */
+  get isGCP() {
+    return this.compositeType === TYPE_HOST_CATALOG_PLUGIN_GCP;
  }

  /**
@@ -5,7 +5,7 @@

 import GeneratedRoleModel from '../generated/models/role';
 import { attr } from '@ember-data/model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 export const GRANT_SCOPE_THIS = 'this';
 export const GRANT_SCOPE_CHILDREN = 'children';
@@ -5,7 +5,7 @@

 import GeneratedSessionRecordingModel from '../generated/models/session-recording';
 import { hasMany } from '@ember-data/model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 export const TYPE_SESSION_RECORDING_SSH = 'ssh';
 export const TYPES_SESSION_RECORDING = Object.freeze([
@@ -71,7 +71,15 @@ export default class SessionRecordingModel extends GeneratedSessionRecordingMode
  }

  /**
-   * Reapply policy dates via the `reapply-staorage-policy` method.
+   * Returns true if retention of session-recording is forever.
+   * @type {boolean}
+   */
+  get retainForever() {
+    return this.retain_until?.toISOString() === '9999-12-31T23:23:23.999Z';
+  }
+
+  /**
+   * Reapply policy dates via the `reapply-storage-policy` method.
   * @param {object} options
   * @param {object} options.adapterOptions
   * @return {Promise}
@@ -7,7 +7,10 @@ import GeneratedSessionModel from '../generated/models/session';
 import { equal } from '@ember/object/computed';
 import { tracked } from '@glimmer/tracking';
 import { A } from '@ember/array';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';
+import { flattenObject } from '../utils/flatten-nested-object';
+import { TYPES_CREDENTIAL_LIBRARY } from 'api/models/credential-library';
+import { TYPE_CREDENTIAL_JSON } from 'api/models/credential';

 export const STATUS_SESSION_ACTIVE = 'active';
 export const STATUS_SESSION_PENDING = 'pending';
@@ -23,7 +26,7 @@ export const statusTypes = [
 /**
 *
 */
-class SessionCredential {
+export class SessionCredential {
  // =classes

  /**
@@ -34,12 +37,14 @@ class SessionCredential {
    name;
    description;
    type;
+    credentialtype;

-    constructor(id, name, description, type) {
+    constructor(id, name, description, type, credentialtype) {
      this.id = id;
      this.name = name;
      this.description = description;
      this.type = type;
+      this.credentialType = credentialtype;
    }
  };

@@ -75,8 +80,10 @@ class SessionCredential {
  get secrets() {
    if (this.#payloadSecret?.decoded) {
      const secretJSON = this.#payloadSecret.decoded;
-      return Object.keys(secretJSON).map(
-        (key) => new SessionCredential.SecretItem(key, secretJSON[key]),
+      return this.extractSecrets(
+        secretJSON,
+        this.source.type,
+        this.source.credentialType,
      );
    } else {
      // decode from base64
@@ -85,11 +92,41 @@ class SessionCredential {
    }
  }

+  /**
+   * Extracts secrets from the payload secret JSON object.
+   * We only need to flatten the object if the type is vault or if its a json type credential.
+   * @param {object} secretJSON - The payload secret JSON object.
+   * @param {string} type - The credential source type.
+   * @param {string} credentialType - The credential type.
+   * @returns {SessionCredential.SecretItem[]} - The array of secret items.
+   */
+  extractSecrets(secretJSON, type, credentialType) {
+    let source;
+    if (credentialType === TYPE_CREDENTIAL_JSON) {
+      source = flattenObject(secretJSON);
+    } else if (TYPES_CREDENTIAL_LIBRARY.includes(type) && secretJSON?.data) {
+      source = flattenObject(secretJSON.data);
+    } else {
+      source = secretJSON;
+    }
+
+    return Object.entries(source).map(
+      ([key, value]) => new SessionCredential.SecretItem(key, value),
+    );
+  }
+
  // =methods

  constructor(cred) {
-    const { id, name, description, type } = cred.credential_source;
-    this.source = new SessionCredential.Source(id, name, description, type);
+    const { id, name, description, type, credential_type } =
+      cred.credential_source;
+    this.source = new SessionCredential.Source(
+      id,
+      name,
+      description,
+      type,
+      credential_type,
+    );
    this.#payloadSecret = cred.secret;
    this.rawCredential = cred;
  }
@@ -4,6 +4,7 @@
 */

 import GeneratedStorageBucketModel from '../generated/models/storage-bucket';
+import { tracked } from '@glimmer/tracking';

 export const TYPE_STORAGE_BUCKET_PLUGIN = 'plugin';
 export const TYPES_STORAGE_BUCKET = Object.freeze([TYPE_STORAGE_BUCKET_PLUGIN]);
@@ -26,7 +27,8 @@ export const TYPES_CREDENTIALS = Object.freeze([
 export default class StorageBucketModel extends GeneratedStorageBucketModel {
  // attributes

-  #credentialType;
+  @tracked _credentialTypeValue;
+
  /**
   * True if the storage bucket is a plugin.
   * @type {boolean}
@@ -40,14 +42,14 @@ export default class StorageBucketModel extends GeneratedStorageBucketModel {
   * @type {string}
   */
  get credentialType() {
-    if (!this.#credentialType) {
+    if (!this._credentialTypeValue) {
      if (this.role_arn) {
-        this.#credentialType = TYPE_CREDENTIAL_DYNAMIC;
+        return TYPE_CREDENTIAL_DYNAMIC;
      } else {
-        this.#credentialType = TYPE_CREDENTIAL_STATIC;
+        return TYPE_CREDENTIAL_STATIC;
      }
    }
-    return this.#credentialType;
+    return this._credentialTypeValue;
  }

  /**
@@ -55,8 +57,9 @@ export default class StorageBucketModel extends GeneratedStorageBucketModel {
   * @type {string}
   */
  set credentialType(type) {
-    this.#credentialType = type;
+    this._credentialTypeValue = type;
  }
+
  /**
   * True if the storage bucket is an unknown type.
   * @type {boolean}
@@ -5,7 +5,7 @@

 import GeneratedTargetModel from '../generated/models/target';
 import { attr } from '@ember-data/model';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 export const TYPE_TARGET_TCP = 'tcp';
 export const TYPE_TARGET_SSH = 'ssh';
@@ -6,6 +6,7 @@
 import RESTSerializer from '@ember-data/serializer/rest';
 import { underscore } from '@ember/string';
 import { get } from '@ember/object';
+import { typeOf } from '@ember/utils';

 /**
 * Manages serialization/normalization of data to/from the API.
@@ -42,7 +43,7 @@ export default class ApplicationSerializer extends RESTSerializer {
   */
  serializeAttribute(snapshot, json, key, attribute) {
    const { type, options } = attribute;
-    const { type: recordType } = snapshot.record;
+    const { type: recordType, compositeType } = snapshot.record;
    let value = super.serializeAttribute(...arguments);
    // Remove secret attributes that are null or empty
    if (options.isSecret) {
@@ -59,6 +60,18 @@ export default class ApplicationSerializer extends RESTSerializer {
    // Do not serialize `disabled` fields.
    // TODO:  disabled is temporarily disabled
    if (key === 'disabled') delete json[key];
+
+    // Before we transform our json
+    // Let's trim the values in the json obj
+    // Currently, json values will only ever be a string or an array
+    if (options.trimWhitespace && json[key]) {
+      if (typeOf(json[key]) === 'array') {
+        json[key] = json[key].map((str) => str.trim());
+      } else if (typeOf(json[key] === 'string')) {
+        json[key] = json[key].trim();
+      }
+    }
+
    // Push nested attributes down into the attributes key
    if (options.isNestedAttribute && json[key] !== undefined) {
      if (!json.attributes) json.attributes = {};
@@ -74,18 +87,38 @@ export default class ApplicationSerializer extends RESTSerializer {
      delete json[key];
    }
    // If an attribute has a `for` option, it must match the
-    // record's `type`, else the attribute is excluded
+    // record's `type`, otherwise the attribute is excluded
    // from serialization.
-    //note: This doesn't handle secrets yet, we can add support for them if needed.
-    if (
-      options?.for &&
-      options.for !== recordType &&
-      !options.for.includes(recordType)
-    ) {
-      if (options.isNestedAttribute) {
-        delete json?.attributes?.[key];
-      } else {
-        delete json[key];
+
+    if (options?.for) {
+      // Check the typeof the `for` option to determine if it is a plugin or not
+      const isPlugin = options.for?.type === 'plugin';
+      // Helper function to handle deleting attribute and secret keys
+      const deleteKey = (json) => {
+        if (options.isNestedAttribute) {
+          delete json?.attributes?.[key];
+        } else if (options.isNestedSecret && json?.secrets?.[key]) {
+          delete json?.secrets?.[key];
+          if (Object.keys(json.secrets).length === 0) {
+            delete json.secrets;
+          }
+        } else {
+          delete json[key];
+        }
+      };
+
+      // For plugins, the `for` option is an object with a `name` key
+      // For non-plugins, the `for` option can be string or an array
+      if (
+        (isPlugin && !options.for?.name.includes(compositeType)) ||
+        (!isPlugin &&
+          !options.for?.includes(recordType) &&
+          typeOf(options.for) === 'array') ||
+        (!isPlugin &&
+          options.for !== recordType &&
+          typeOf(options.for) === 'string')
+      ) {
+        deleteKey(json);
      }
    }
    return value;
@@ -211,12 +244,10 @@ export default class ApplicationSerializer extends RESTSerializer {
   * @return {object}
   */
  normalizeMissingArrays(store, primaryModelClass, payload) {
-    const attrDefs = store
-      .getSchemaDefinitionService()
-      .attributesDefinitionFor({ type: primaryModelClass.modelName });
+    const attrDefs = store.schema.fields({ type: primaryModelClass.modelName });
    if (attrDefs) {
-      Object.keys(attrDefs).forEach((key) => {
-        if (!payload[key] && attrDefs[key]?.options?.emptyArrayIfMissing) {
+      attrDefs.keys().forEach((key) => {
+        if (!payload[key] && attrDefs.get(key)?.options?.emptyArrayIfMissing) {
          payload[key] = [];
        }
      });
@@ -235,12 +266,10 @@ export default class ApplicationSerializer extends RESTSerializer {
   * @return {object}
   */
  normalizeMissingObjects(store, primaryModelClass, payload) {
-    const attrDefs = store
-      .getSchemaDefinitionService()
-      .attributesDefinitionFor({ type: primaryModelClass.modelName });
+    const attrDefs = store.schema.fields({ type: primaryModelClass.modelName });
    if (attrDefs) {
-      Object.keys(attrDefs).forEach((key) => {
-        if (!payload[key] && attrDefs[key]?.options?.emptyObjectIfMissing) {
+      attrDefs.keys().forEach((key) => {
+        if (!payload[key] && attrDefs.get(key)?.options?.emptyObjectIfMissing) {
          payload[key] = {};
        }
      });
@@ -28,6 +28,7 @@ export default class CredentialLibrarySerializer extends ApplicationSerializer {
      case TYPE_CREDENTIAL_LIBRARY_VAULT_GENERIC:
        return this.serializeVaultGeneric(...arguments);
      case TYPE_CREDENTIAL_LIBRARY_VAULT_SSH_CERTIFICATE:
+        return this.serializeVaultSshCertificate(...arguments);
      default:
        return super.serialize(...arguments);
    }
@@ -61,4 +62,16 @@ export default class CredentialLibrarySerializer extends ApplicationSerializer {
      return serialized;
    }
  }
+
+  serializeVaultSshCertificate() {
+    const serialized = super.serialize(...arguments);
+    if (serialized.attributes) {
+      const { key_type } = serialized.attributes;
+      if (key_type !== 'rsa' && key_type !== 'ecdsa') {
+        // If the key type is not RSA or ECDSA, set key_bits to null
+        serialized.attributes.key_bits = null;
+      }
+      return serialized;
+    }
+  }
 }
@@ -4,61 +4,45 @@
 */

 import ApplicationSerializer from './application';
-
-const fieldsByType = {
-  aws: [
-    'disable_credential_rotation',
-    'region',
-    'access_key_id',
-    'secret_access_key',
-  ],
-  azure: [
-    'disable_credential_rotation',
-    'tenant_id',
-    'client_id',
-    'subscription_id',
-    'secret_id',
-    'secret_value',
-  ],
-};
+import { TYPE_CREDENTIAL_DYNAMIC } from '../models/host-catalog';

 export default class HostCatalogSerializer extends ApplicationSerializer {
-  // =methods
  serialize(snapshot) {
+    const { credentialType } = snapshot.record;
    const serialized = super.serialize(...arguments);
-    switch (snapshot.record.compositeType) {
-      case 'static':
-        return this.serializeStatic(...arguments);
-      default:
-        return serialized;
+    // By default, disable credential rotation for dynamic credentials
+    if (credentialType === TYPE_CREDENTIAL_DYNAMIC) {
+      serialized.attributes.disable_credential_rotation = true;
    }
+    return serialized;
  }

  serializeAttribute(snapshot, json, key, attribute) {
    const value = super.serializeAttribute(...arguments);
-    const { isPlugin, compositeType } = snapshot.record;
+    const { compositeType, credentialType } = snapshot.record;
    const { options } = attribute;
-    // Nested conditionals for readability
-    // This deletes any fields that don't belong to the record type
-    if (isPlugin && options.isNestedAttribute && json.attributes) {
-      // The key must be included in the fieldsByType list above
-      if (!fieldsByType[compositeType].includes(key))
-        delete json.attributes[key];
-    }
-    // This deletes any fields that don't belong to the record type
-    if (isPlugin && options.isNestedSecret && json.secrets) {
-      if (!fieldsByType[compositeType].includes(key)) delete json.secrets[key];
-    }
+    const isSamePluginName = options?.for?.name?.includes(compositeType);

-    // new one for isNestedSecret
+    // Remove attributes that are not applicable to the current credential type for the same plugin
+    // For example, 'aws' dynamic plugin has two credential types: 'static' and 'dynamic'
+    // API expects the fields to be 'null' for the fields that are not from the current credential type (that's why we are not using the application serializer for this, where we delete attrs)
+    // Empty secrets should be removed from the JSON
+    if (
+      isSamePluginName &&
+      options.for.credentialType &&
+      options.for.credentialType !== credentialType
+    ) {
+      if (options.isNestedAttribute) {
+        json.attributes[key] = null;
+      } else if (options.isNestedSecret && json.secrets?.[key]) {
+        delete json.secrets[key];
+        if (Object.keys(json.secrets).length === 0) {
+          delete json.secrets;
+        }
+      } else {
+        delete json[key];
+      }
+    }
    return value;
  }
-
-  serializeStatic() {
-    const serialized = super.serialize(...arguments);
-    // Delete unnecessary fields for static host-catalog
-    delete serialized.attributes;
-    delete serialized.secrets;
-    return serialized;
-  }
 }
@@ -5,10 +5,6 @@

 import ApplicationSerializer from './application';

-const fieldByType = {
-  aws: ['preferred_endpoints', 'filters', 'sync_interval_seconds'],
-  azure: ['preferred_endpoints', 'filter_string', 'sync_interval_seconds'],
-};
 export default class HostSetSerializer extends ApplicationSerializer {
  // =properties

@@ -63,16 +59,8 @@ export default class HostSetSerializer extends ApplicationSerializer {
    return serialized;
  }

-  serializeAttribute(snapshot, json, key, attribute) {
+  serializeAttribute(snapshot, json, key) {
    const value = super.serializeAttribute(...arguments);
-    const { isPlugin, compositeType } = snapshot.record;
-    const { options } = attribute;
-
-    if (isPlugin && options.isNestedAttribute) {
-      if (!fieldByType[compositeType].includes(key)) {
-        delete json.attributes[key];
-      }
-    }

    if (key === 'filter_string') {
      const { filter_string } = json.attributes;
@@ -107,4 +95,18 @@ export default class HostSetSerializer extends ApplicationSerializer {

    return super.normalize(typeClass, normalizedHash, ...rest);
  }
+
+  /**
+   * Extracts errors from the payload and transforms specific keys if needed.
+   * @override
+   * @return {object}
+   */
+  extractErrors() {
+    const errors = super.extractErrors(...arguments);
+    if (errors?.filter) {
+      errors.filter_string = errors.filter;
+      delete errors.filter;
+    }
+    return errors;
+  }
 }
@@ -53,4 +53,18 @@ export default class ManagedGroupSerializer extends ApplicationSerializer {

    return super.normalize(typeClass, normalizedHash, ...rest);
  }
+
+  /**
+   * Extracts errors from the payload and transforms specific keys if needed.
+   * @override
+   * @return {object}
+   */
+  extractErrors() {
+    const errors = super.extractErrors(...arguments);
+    if (errors?.filter) {
+      errors.filter_string = errors.filter;
+      delete errors.filter;
+    }
+    return errors;
+  }
 }
@@ -72,6 +72,7 @@ export default class StorageBucketSerializer extends ApplicationSerializer {
    const value = super.serializeAttribute(...arguments);
    const { credentialType } = snapshot.record;
    const { options } = attribute;
+
    // This deletes any fields that don't belong to the record's credential type
    if (options.isNestedAttribute && json.attributes) {
      // The key must be included in the fieldsByType list above
@@ -29,6 +29,10 @@ export const modelIndexes = {
    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.scope.scope_id, attributes.plugin.name',
  'auth-method':
    '&id, attributes.created_time, attributes.type, attributes.name, attributes.description, attributes.is_primary, attributes.scope.scope_id',
+  'session-recording':
+    '&id, attributes.created_time, attributes.type, attributes.state, attributes.start_time, attributes.end_time, attributes.duration, attributes.scope.scope_id, attributes.create_time_values.user.id, attributes.create_time_values.user.name, attributes.create_time_values.target.id, attributes.create_time_values.target.name, attributes.create_time_values.target.scope.id, attributes.create_time_values.target.scope.name',
+  alias:
+    '&id, attributes.created_time, attributes.type, attributes.value, attributes.name, attributes.description, attributes.destination_id, attributes.scope.scope_id',
 };

 export const formatDbName = (userId, clusterUrl) =>
@@ -93,23 +97,42 @@ const unconvertFields = (result, object, schema, serializer) => {

 /**
 * Service to encapsulate the IndexedDB implementation. To use this service, call
- * `setup` from the application root and
+ * `setup` from the application root. This will create the database and the necessary indexes.
+ *
+ * Make sure to increment the version number of the database whenever the indexes change.
+ * This will delete the old database and create a new one with the new indexes.
 */
 export default class IndexedDbService extends Service {
  // =attributes
  #db;
+  #version = 2;
+
  get db() {
    return this.#db;
  }

-  setup(dbName) {
+  async setup(dbName) {
    // Don't run setup again if we already have one or if we didn't get a name
    if (this.#db || !dbName) {
      return;
    }

+    const doesDbExist = await Dexie.exists(dbName);
+
+    // If the database already exists, open the database and
+    // check if the version is a lower version than the current one
+    if (doesDbExist) {
+      const dbVerifier = new Dexie(dbName);
+      await dbVerifier.open();
+      if (dbVerifier.verno < this.#version) {
+        await dbVerifier.delete();
+      } else {
+        dbVerifier.close();
+      }
+    }
+
    this.#db = new Dexie(dbName);
-    this.#db.version(1).stores(modelIndexes);
+    this.#db.version(this.#version).stores(modelIndexes);
  }

  /**
@@ -4,7 +4,7 @@
 */

 import Service from '@ember/service';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 /**
 * Takes a POJO representing a query and converts it to a boolean expression
@@ -56,7 +56,7 @@ class MemoryStorage {
 *
 * @example
 *   import Route from '@ember/routing/route';
- *   import { inject as service } from '@ember/service';
+ *   import { service } from '@ember/service';
 *   export default class ApplicationRoute extends Route {
 *     @service storage;
 *     afterModel() {
@@ -3,7 +3,11 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Store, { CacheHandler } from '@ember-data/store';
+// Importing 'Store' from 'ember-data/store' to get default configuration automatically.
+// TODO: Remove eslint-disable after upgrading to eslint-plugin-ember >= v12.2.1
+// eslint-disable-next-line ember/use-ember-data-rfc-395-imports
+import Store from 'ember-data/store';
+import { CacheHandler } from '@ember-data/store';
 import RequestManager from '@ember-data/request';
 import { LegacyNetworkHandler } from '@ember-data/legacy-compat';
 import IndexedDbHandler from 'api/handlers/indexed-db-handler';
@@ -3,9 +3,7 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
-
-export default class AccountValueMapArrayTransform extends Transform {
+export default class AccountValueMapArrayTransform {
  deserialize(serialized) {
    const accountValues = serialized || [];
    return accountValues.map((accountValueString) => ({
@@ -18,4 +16,8 @@ export default class AccountValueMapArrayTransform extends Transform {
    const accountValues = deserialized || [];
    return accountValues.map(({ key, value }) => `${key}=${value}`);
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,10 +3,9 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
 import { TrackedArray } from 'tracked-built-ins';

-export default class ArrayTransform extends Transform {
+export default class ArrayTransform {
  deserialize(serialized) {
    const arr = new TrackedArray(serialized || []);
    return arr;
@@ -16,4 +15,8 @@ export default class ArrayTransform extends Transform {
    const arr = deserialized || [];
    return arr;
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,9 +3,7 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
-
-export default class DurationTransform extends Transform {
+export default class DurationTransform {
  /**
   * Normalize a duration string in the format "3.0001s" to milliseconds.
   * The backend returns a precision of nanoseconds but we round to whole
@@ -37,4 +35,8 @@ export default class DurationTransform extends Transform {
      maximumFractionDigits: 9,
    })}s`;
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,9 +3,7 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
-
-export default class HostSourceIdArrayTransform extends Transform {
+export default class HostSourceIdArrayTransform {
  deserialize(serialized) {
    const stringValues = serialized || [];
    return stringValues.map(({ id: host_source_id, ...obj }) => ({
@@ -18,4 +16,8 @@ export default class HostSourceIdArrayTransform extends Transform {
    const strings = deserialized || [];
    return strings.map(({ host_source_id: id, ...obj }) => ({ id, ...obj }));
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,13 +3,12 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
-
-export default class ObjectAsArrayTransform extends Transform {
+export default class ObjectAsArrayTransform {
  deserialize(serialized) {
    const obj = serialized || {};
    return Object.entries(obj).map(([key, value]) => ({ key, value }));
  }
+
  serialize(deserialized) {
    const array = deserialized || [];

@@ -24,4 +23,8 @@ export default class ObjectAsArrayTransform extends Transform {
      return result;
    }, {});
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,10 +3,9 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
 import { TrackedObject } from 'tracked-built-ins';

-export default class ObjectTransform extends Transform {
+export default class ObjectTransform {
  /**
   * @param serialized
   * @returns {object}
@@ -26,4 +25,8 @@ export default class ObjectTransform extends Transform {
    }
    return deserialized;
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -3,9 +3,7 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-import Transform from '@ember-data/serializer/transform';
-
-export default class StringArrayTransform extends Transform {
+export default class StringArrayTransform {
  deserialize(serialized) {
    const stringValues = serialized || [];
    return stringValues.map((value) => ({ value }));
@@ -15,4 +13,8 @@ export default class StringArrayTransform extends Transform {
    const strings = deserialized || [];
    return strings.map(({ value }) => value);
  }
+
+  static create() {
+    return new this();
+  }
 }
@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import { typeOf } from '@ember/utils';
+
+/**
+ * Flattens a nested object into a single-level object.
+ * @param obj
+ * @param result
+ * @param parentKey
+ * @returns {Object}
+ */
+
+export const flattenObject = (obj, result = {}, parentKey = '') => {
+  for (const key in obj) {
+    // Check if the value is an object and it is not null
+    if (typeOf(obj[key]) === 'object' && obj[key] !== null) {
+      // Recursively flatten the object
+      flattenObject(obj[key], result, `${parentKey}${key}.`);
+    } else if (obj[key] !== null && obj[key] !== '') {
+      // Only add to result if the value is not null or an empty string
+      result[`${parentKey}${key}`] = obj[key];
+    }
+  }
+  return result;
+};
@@ -70,14 +70,9 @@ export async function queryIndexedDb(indexedDb, resource, query) {
    );
  }

-  // OrderBy has to be used on where clauses while if it's a
-  // collection already we have to use sortBy. We'll also sort by
-  // descending order based on created time to match the API as any
-  // "or" clause can change the order
-  if (filterCollection.orderBy) {
-    return filterCollection.orderBy(getKey('created_time')).reverse().toArray();
-  }
-  return filterCollection.reverse().sortBy(getKey('created_time'));
+  // filterCollection can be Dexie Table or a Dexie Collection.
+  // This is an important detail you need to keep in mind when working on it.
+  return filterCollection.toArray();
 }

 const buildInitialWhereClause = ({ filterArrayOrObject, table, key }) => {
@@ -0,0 +1,84 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// created_time is not an attribute defined on all models, but is present in all the resources
+// coming from API
+const SORT_DEFAULT_ATTRIBUTE = 'created_time';
+const SORT_DIRECTION_ASCENDING = 'asc';
+const SORT_DIRECTION_DESCENDING = 'desc';
+
+const sortFunctions = {
+  string: (a, b) => String(a).localeCompare(String(b)),
+  date: (a, b) => new Date(a).getTime() - new Date(b).getTime(),
+  number: (a, b) => Number(a) - Number(b),
+  boolean: (a, b) => Number(a) - Number(b),
+};
+
+function getSortableValue(schema, record, attribute) {
+  if (attribute === 'id') {
+    return record.id;
+  }
+
+  // all models have a created_time attribute but not all models have it defined
+  if (attribute === 'created_time') {
+    return record.attributes.created_time;
+  }
+
+  if (schema.attributes.has(attribute)) {
+    return record.attributes[attribute];
+  }
+
+  const attributes = Array.from(schema.attributes.keys());
+  throw new Error(
+    `The attribute "${attribute}" does not map to the model definition of type "${record.type}". Supported sortable attributes are 'id', 'created_time', or ${attributes.map((attr) => `'${attr}'`).join(', ')}`,
+  );
+}
+
+export const sortResults = (results, { querySort, schema }) => {
+  querySort = querySort ?? {};
+  const sortAttribute = querySort.attribute || SORT_DEFAULT_ATTRIBUTE;
+
+  // Default sort direction is ascending unless we are sorting by `created_time` (default sort attribute)
+  const defaultSortDirection =
+    sortAttribute === SORT_DEFAULT_ATTRIBUTE && !querySort.sortFunction
+      ? SORT_DIRECTION_DESCENDING
+      : SORT_DIRECTION_ASCENDING;
+  const sortDirection = querySort.direction || defaultSortDirection;
+
+  if (
+    ![SORT_DIRECTION_ASCENDING, SORT_DIRECTION_DESCENDING].includes(
+      sortDirection,
+    )
+  ) {
+    throw new Error('Invalid sort direction');
+  }
+
+  // Execute custom sort function if one is provided.
+  if (querySort.sortFunction) {
+    return results.toSorted((a, b) => {
+      const sortResult = querySort.sortFunction(a, b);
+
+      return sortDirection === SORT_DIRECTION_ASCENDING
+        ? sortResult
+        : -1 * sortResult;
+    });
+  }
+
+  const sortAttributeDataType = schema.attributes.get(sortAttribute)?.type;
+
+  const sortFunction =
+    sortFunctions[sortAttributeDataType] ?? sortFunctions.string;
+
+  return results.toSorted((a, b) => {
+    // Extract the values to sort and sort them.
+    const sortValueA = getSortableValue(schema, a, sortAttribute);
+    const sortValueB = getSortableValue(schema, b, sortAttribute);
+    const sortResult = sortFunction(sortValueA, sortValueB);
+
+    return sortDirection === SORT_DIRECTION_ASCENDING
+      ? sortResult
+      : -1 * sortResult;
+  });
+};
@@ -0,0 +1,7 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// Ember-data no longer automatically installs BooleanTransform for apps.
+export { BooleanTransform as default } from '@ember-data/serializer/transform';
@@ -3,4 +3,4 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-export { default, initialize } from 'core/initializers/deprecations';
+export { DateTransform as default } from '@ember-data/serializer/transform';
@@ -3,4 +3,4 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-export { default, initialize } from 'api/initializers/deprecations';
+export { NumberTransform as default } from '@ember-data/serializer/transform';
@@ -0,0 +1,7 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// Ember-data no longer automatically installs StringTransform for apps.
+export { StringTransform as default } from '@ember-data/serializer/transform';
@@ -6,7 +6,6 @@
 'use strict';

 const EmberAddon = require('ember-cli/lib/broccoli/ember-addon');
-const { maybeEmbroider } = require('@embroider/test-setup');

 module.exports = function (defaults) {
  const app = new EmberAddon(defaults, {
@@ -19,6 +18,8 @@ module.exports = function (defaults) {
    This build file does *not* influence how the addon or the app using it
    behave. You most likely want to be modifying `./index.js` or app's build file
  */
+
+  const { maybeEmbroider } = require('@embroider/test-setup');
  return maybeEmbroider(app, {
    skipBabel: [
      {
@@ -25,7 +25,10 @@ const isTesting = environmentConfig.environment === 'test';
 export default function (mirageConfig) {
  let finalConfig = {
    ...mirageConfig,
-    models: { ...discoverEmberDataModels(), ...mirageConfig.models },
+    models: {
+      ...discoverEmberDataModels(mirageConfig.store),
+      ...mirageConfig.models,
+    },
    serializers: applyEmberDataSerializers(mirageConfig.serializers),
    routes,
  };
@@ -775,18 +778,7 @@ function routes() {
  });

  // session recordings
-  this.get(
-    '/session-recordings',
-    (
-      { sessionRecordings },
-      { queryParams: { scope_id: scopeId, recursive } },
-    ) => {
-      if (recursive && scopeId === 'global') {
-        return sessionRecordings.all();
-      }
-      return sessionRecordings.where({ scopeId });
-    },
-  );
+  this.get('/session-recordings');
  this.get(
    '/session-recordings/:idMethod',
    async ({ sessionRecordings }, { params: { idMethod } }) => {
@@ -50,7 +50,8 @@ export default factory.extend({
      }
      case TYPE_AUTH_METHOD_OIDC:
        return {
-          issuer: faker.internet.ip(),
+          issuer:
+            Math.random() > 0.5 ? faker.internet.ip() : faker.internet.ipv6(),
          subject: 'sub',
          email: faker.internet.email(),
          full_name: faker.person.fullName(),
@@ -39,7 +39,8 @@ export default factory.extend({
    switch (this.type) {
      case 'vault':
        return {
-          address: faker.internet.ip(),
+          address:
+            Math.random() > 0.5 ? faker.internet.ip() : faker.internet.ipv6(),
          namespace: faker.word.words(1),
          ca_cert: 'ca-cert-123',
          tls_server_name: faker.internet.domainName(),
@@ -8,19 +8,29 @@ import { trait } from 'miragejs';
 import permissions from '../helpers/permissions';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';
+import {
+  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+  TYPE_HOST_CATALOG_PLUGIN_GCP,
+  TYPE_HOST_CATALOG_PLUGIN_AWS,
+  TYPE_HOST_CATALOG_STATIC,
+  TYPE_HOST_CATALOG_DYNAMIC,
+  TYPES_HOST_CATALOG,
+} from 'api/models/host-catalog';

-const types = ['static', 'plugin'];
 // Represents known plugin types, except "foobar" which models the possibility
 // of receiving an _unknown_ type, which the UI must handle gracefully.
-const pluginTypes = ['aws', 'azure', 'foobar'];
-
-let pluginTypeCounter = 1;
+const pluginTypes = [
+  TYPE_HOST_CATALOG_PLUGIN_GCP,
+  TYPE_HOST_CATALOG_PLUGIN_AWS,
+  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+  'foobar',
+];

 export default factory.extend({
  id: () => generateId('hc_'),

  // Cycle through available types
-  type: (i) => types[i % types.length],
+  type: (i) => TYPES_HOST_CATALOG[i % TYPES_HOST_CATALOG.length],

  authorized_actions: () =>
    permissions.authorizedActionsFor('host-catalog') || [
@@ -30,7 +40,7 @@ export default factory.extend({
      'delete',
    ],
  authorized_collection_actions: function () {
-    const isStatic = this.type === 'static';
+    const isStatic = this.type === TYPE_HOST_CATALOG_STATIC;
    return {
      // only static catalogs allow host create at this time
      hosts: isStatic ? ['create', 'list'] : ['list'],
@@ -38,11 +48,21 @@ export default factory.extend({
    };
  },

+  worker_filter: function () {
+    if (
+      this.type === TYPE_HOST_CATALOG_DYNAMIC &&
+      (this.plugin?.name === TYPE_HOST_CATALOG_PLUGIN_AWS ||
+        this.plugin?.name === TYPE_HOST_CATALOG_PLUGIN_GCP)
+    ) {
+      return `"${faker.word.noun()}" in "${faker.system.directoryPath()}"`;
+    }
+  },
+
  plugin: function (i) {
-    if (this.type === 'plugin') {
+    if (this.type === TYPE_HOST_CATALOG_DYNAMIC) {
      return {
        id: `plugin-id-${i}`,
-        name: pluginTypes[pluginTypeCounter++ % pluginTypes.length],
+        name: pluginTypes[i % pluginTypes.length],
        description: faker.word.words(),
      };
    }
@@ -50,35 +70,50 @@ export default factory.extend({

  attributes() {
    switch (this.plugin?.name) {
-      case 'aws':
+      case TYPE_HOST_CATALOG_PLUGIN_AWS:
        return {
          disable_credential_rotation: faker.datatype.boolean(),
          region: `us-${faker.location.cardinalDirection()}-${faker.number.int(
            9,
          )}`,
        };
-      case 'azure':
+      case TYPE_HOST_CATALOG_PLUGIN_AZURE:
        return {
          disable_credential_rotation: faker.datatype.boolean(),
          tenant_id: faker.string.uuid(),
          client_id: faker.string.uuid(),
          subscription_id: faker.string.uuid(),
        };
+      case TYPE_HOST_CATALOG_PLUGIN_GCP:
+        return {
+          disable_credential_rotation: faker.datatype.boolean(),
+          project_id: faker.string.uuid(),
+          client_email: faker.internet.email(),
+          target_service_account_id: faker.string.uuid(),
+          zone: `us-${faker.location.cardinalDirection()}${faker.number.int(
+            9,
+          )}-${faker.string.fromCharacters('abc')}`,
+        };
    }
  },

  secrets() {
    switch (this.plugin?.name) {
-      case 'aws':
+      case TYPE_HOST_CATALOG_PLUGIN_AWS:
        return {
          access_key_id: faker.string.nanoid(),
          secret_access_key: faker.string.nanoid(),
        };
-      case 'azure':
+      case TYPE_HOST_CATALOG_PLUGIN_AZURE:
        return {
          secret_id: faker.string.nanoid(),
          secret_value: faker.string.nanoid(),
        };
+      case TYPE_HOST_CATALOG_PLUGIN_GCP:
+        return {
+          private_key: faker.string.nanoid(),
+          private_key_id: faker.string.nanoid(),
+        };
    }
  },
  withChildren: trait({
@@ -7,6 +7,22 @@ import factory from '../generated/factories/host-set';
 import permissions from '../helpers/permissions';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';
+import {
+  TYPE_HOST_CATALOG_PLUGIN_AWS,
+  TYPE_HOST_CATALOG_PLUGIN_AZURE,
+  TYPE_HOST_CATALOG_PLUGIN_GCP,
+} from 'api/models/host-catalog';
+
+function generateFilters(prefix) {
+  const filtersAmount = faker.number.int({ min: 1, max: 5 });
+  let filters = [];
+  for (let i = 0; i < filtersAmount; ++i) {
+    filters.push(`${prefix}${faker.word.words(1)}=${faker.word.words(1)}`);
+  }
+  return {
+    filters,
+  };
+}

 export default factory.extend({
  id: () => generateId('hs_'),
@@ -27,10 +43,12 @@ export default factory.extend({
  },
  preferred_endpoints() {
    if (this.type === 'plugin') {
-      const enpointsAmount = faker.number.int({ min: 1, max: 5 });
+      const endpointsAmount = faker.number.int({ min: 1, max: 5 });
      let result = [];
-      for (let i = 0; i < enpointsAmount; ++i) {
-        result.push(faker.internet.ip());
+      for (let i = 0; i < endpointsAmount; ++i) {
+        result.push(
+          Math.random() > 0.5 ? faker.internet.ip() : faker.internet.ipv6(),
+        );
      }
      return result;
    }
@@ -42,22 +60,15 @@ export default factory.extend({
  },

  attributes() {
-    // AWS specific
-    if (this.plugin?.name === 'aws') {
-      const filtersAmount = faker.number.int({ min: 1, max: 5 });
-      let filters = [];
-      for (let i = 0; i < filtersAmount; ++i) {
-        filters.push(`${faker.word.words(1)}=${faker.word.words(1)}`);
-      }
-      return {
-        filters,
-      };
-    }
-    // Azure specific
-    if (this.plugin?.name === 'azure') {
-      return {
-        filter: `${faker.database.column()}=${faker.database.collation()}`,
-      };
+    switch (this.plugin?.name) {
+      case TYPE_HOST_CATALOG_PLUGIN_AWS:
+        return generateFilters('tag:');
+      case TYPE_HOST_CATALOG_PLUGIN_AZURE:
+        return {
+          filter: `${faker.database.column()}=${faker.database.collation()}`,
+        };
+      case TYPE_HOST_CATALOG_PLUGIN_GCP:
+        return generateFilters('labels.');
    }
  },
 });
@@ -7,24 +7,28 @@ import factory from '../generated/factories/host';
 import permissions from '../helpers/permissions';
 import { faker } from '@faker-js/faker';
 import generateId from '../helpers/id';
+import {
+  TYPE_HOST_CATALOG_STATIC,
+  TYPE_HOST_CATALOG_DYNAMIC,
+} from 'api/models/host-catalog';

 export default factory.extend({
  id: () => generateId('h_'),
  name() {
-    if (this.type === 'static') return faker.word.words();
+    if (this.type === TYPE_HOST_CATALOG_STATIC) return faker.word.words();
  },
  type() {
    return this.hostCatalog?.type || factory.attrs.type;
  },
  authorized_actions: function () {
-    const isStatic = this.type === 'static';
+    const isStatic = this.type === TYPE_HOST_CATALOG_STATIC;
    const defaults = ['no-op', 'read'];
    // Only static allows update/delete at this time.
    if (isStatic) defaults.push('update', 'delete');
    return permissions.authorizedActionsFor('host') || defaults;
  },
  plugin() {
-    if (this.type === 'plugin') {
+    if (this.type === TYPE_HOST_CATALOG_DYNAMIC) {
      return this.hostCatalog.plugin;
    }
  },
@@ -32,18 +36,20 @@ export default factory.extend({
    const addressesAmount = Math.floor(Math.random() * 6) + 1;
    let result = [];
    for (let i = 0; i < addressesAmount; ++i) {
-      result.push(faker.internet.ip());
+      result.push(
+        Math.random() > 0.5 ? faker.internet.ip() : faker.internet.ipv6(),
+      );
    }
    return result;
  },
  // Return external fields only for plugins
  external_id() {
-    if (this.type === 'plugin') {
+    if (this.type === TYPE_HOST_CATALOG_DYNAMIC) {
      return faker.string.uuid();
    }
  },
  external_name(i) {
-    if (this.type === 'plugin') {
+    if (this.type === TYPE_HOST_CATALOG_DYNAMIC) {
      return `${this.plugin.name} provided name ${i}`;
    }
  },
@@ -15,7 +15,7 @@ export default factory.extend({
  authorized_actions() {
    const authorizedActions = ['no-op', 'read', 'update'];

-    // Storage policies can only be attatched to global and org scopes.
+    // Storage policies can only be attached to global and org scopes.
    if (this.type === 'global' || this.type === 'org') {
      authorizedActions.push('attach-storage-policy', 'detach-storage-policy');
    }
@@ -103,6 +103,31 @@ export default factory.extend({
    },
  }),

+  withManyHosts: trait({
+    afterCreate(target, server) {
+      const { scope } = target;
+      const hostCatalog = server.create('host-catalog', { scope });
+      const hosts = server.createList('host', 15, {
+        scope,
+        hostCatalog,
+        type: hostCatalog.type,
+      });
+      const hostSets = [
+        server.create('host-set', {
+          scope,
+          hostCatalog,
+          hosts,
+          type: hostCatalog.type,
+        }),
+      ];
+      const hostSetIds = hostSets.map((hostSet) => hostSet.id);
+      hosts.forEach((host) => {
+        host.update({ hostSetIds });
+      });
+      target.update({ hostSets });
+    },
+  }),
+
  withTwoHosts: trait({
    afterCreate(target, server) {
      const { scope } = target;
@@ -120,6 +145,10 @@ export default factory.extend({
          type: hostCatalog.type,
        }),
      ];
+      const hostSetIds = hostSets.map((hostSet) => hostSet.id);
+      hosts.forEach((host) => {
+        host.update({ hostSetIds });
+      });
      target.update({ hostSets });
    },
  }),
@@ -139,6 +168,10 @@ export default factory.extend({
          type: hostCatalog.type,
        }),
      ];
+      const hostSetIds = hostSets.map((hostSet) => hostSet.id);
+      hosts.forEach((host) => {
+        host.update({ hostSetIds });
+      });
      target.update({ hostSets });
    },
  }),
@@ -16,6 +16,9 @@ export default Factory.extend({
  updated_time: () => faker.date.recent(),
  version: () => faker.number.int(),
  attributes: () => {
-    return { address: faker.internet.ipv6() };
+    return {
+      address:
+        Math.random() > 0.5 ? faker.internet.ip() : faker.internet.ipv6(),
+    };
  },
 });
@@ -3,31 +3,8 @@
 * SPDX-License-Identifier: BUSL-1.1
 */

-// import config from '../../config/environment';
-// import { v1 } from 'ember-uuid';
 import { Response } from 'miragejs';

-// /**
-//  * Simulates a cookie-based response to authentication requests.  Any user/pass
-//  * values are allowed *except* when `username` equals `error`, in which case a
-//  * simulated error response is returned.
-//  * @param {object} schema
-//  * @param {object} request
-//  * @return {Response}
-//  */
-// export default function authenticateHandler(schema, request) {
-//   const payload = JSON.parse(request.requestBody);
-//   if (payload.attributes.login_name === 'error') {
-//     return new Response(400);
-//   } else {
-//     const cookieName = config.auth.passwordCookieName;
-//     const cookieValue = v1();
-//     const cookiePath = config.rootURL;
-//     document.cookie = `${cookieName}=${cookieValue};path=${cookiePath}`;
-//     return new Response(200);
-//   }
-// }
-
 // Quick and dirty counter system to simulate the polling behavior
 // of the API.  If the OIDC flow is pending, the route returns 100.
 // If complete it returns 200 with the token JSON.
@@ -110,7 +110,18 @@ export default function (server) {

  // Other resources
  server.schema.scopes.where({ type: 'project' }).models.forEach((scope) => {
-    server.createList('host-catalog', 8, { scope }, 'withChildren');
+    server.createList(
+      'host-catalog',
+      2,
+      { scope, type: 'static' },
+      'withChildren',
+    );
+    server.createList(
+      'host-catalog',
+      8,
+      { scope, type: 'plugin' },
+      'withChildren',
+    );
    server.createList('credential-store', 3, { scope }, 'withAssociations');
    server.createList('target', 2, { scope }, 'withAssociations');
    server.create('target', { scope, address: '0.0.0.0' });
@@ -83,6 +83,37 @@ export default function initializeMockIPC(server, config) {
              raw: btoa('just-a-random-string'),
            },
          },
+          {
+            credential_source: {
+              id: 'clvlt_4cvscMTl0N',
+              name: 'Credential Library 0',
+              description: 'Source Description',
+              credential_store_id: 'csvlt_Q1HFGt7Jpm',
+              type: 'vault-generic',
+            },
+            secret: {
+              raw: 'eyJhcnJheSI6WyJvbmUiLCJ0d28iLCJ0aHJlZSIsIm9uZSIsInR3byIsInRocmVlIiwib25lIiwidHdvIiwidGhyZWUiLCJvbmUiLCJ0d28iLCJ0aHJlZSJdLCJuZXN0ZWQiOnsiYm9vbCI6dHJ1ZSwibG9uZyI6IjEyMjM1MzQ1NmFzZWRmYTQzd3J0ZjIzNGYyM2FzZGdmYXNkZnJnYXdzZWZhd3NlZnNkZjQiLCJzZWNlcmV0Ijoic28gbmVzdGVkIn0sInRlc3QiOiJwaHJhc2UifQ',
+              decoded: {
+                data: {
+                  backslash: 'password\\withslash\\',
+                  backslash1: 'password\\fwithslash\\f',
+                  password: '123',
+                  username: 'test',
+                  email: {
+                    address: 'test.com',
+                  },
+                },
+                metadata: {
+                  created_time: '2024-04-12T18:38:36.226715555Z',
+                  custom_metadata: null,
+                  deletion_time: '',
+                  destroyed: false,
+                  version: 8,
+                },
+              },
+            },
+          },
+
          {
            credential_source: {
              id: 'credjson_7cKBbBEkC3',
@@ -98,6 +129,7 @@ export default function initializeMockIPC(server, config) {
                nested_secret: {
                  session_token: 'ZXCVBNMLKJHGFDSAQWERTYUIOP0987654321',
                  complex_nest: {
+                    blackslash: 'password\\withslash\\',
                    hash: 'qazxswedcvfrtgbnjhyujm.1234567890',
                  },
                },
@@ -167,6 +199,9 @@ export default function initializeMockIPC(server, config) {
     * Check for OS chrome state
     */
    showWindowActions() {
+      if (navigator.userAgent.includes('Mac')) {
+        return false;
+      }
      return true;
    }

@@ -190,6 +225,27 @@ export default function initializeMockIPC(server, config) {
    isClientAgentRunning() {
      return false;
    }
+    cacheDaemonStatus() {
+      return { version: 'Boundary v1.0.0' };
+    }
+    getCliVersion() {
+      return { versionNumber: '1.0.0' };
+    }
+    getDesktopVersion() {
+      return { desktopVersion: '1.0.0' };
+    }
+    getLogLevel() {
+      return 'info';
+    }
+    getLogPath() {
+      return '~/.config/Boundary/logs/desktop-client.log';
+    }
+    setLogLevel() {}
+    clientAgentStatus() {
+      return { version: '0.0.1-dev', status: 'running' };
+    }
+    pauseClientAgent() {}
+    resumeClientAgent() {}
  }

  /**
@@ -10,8 +10,10 @@
  "scripts": {
    "build:development": "ember build",
    "build": "ember build --environment=production",
-    "lint": "concurrently \"npm:lint:*(!fix)\" --names \"lint:\"",
-    "lint:fix": "concurrently \"npm:lint:*:fix\" --names \"fix:\"",
+    "lint": "concurrently \"pnpm:lint:*(!fix)\" --names \"lint:\"",
+    "lint:fix": "concurrently \"pnpm:lint:*:fix\" --names \"fix:\"",
+    "lint:hbs": "ember-template-lint .",
+    "lint:hbs:fix": "ember-template-lint . --fix",
    "lint:js": "eslint .",
    "lint:js:fix": "eslint . --fix",
    "format": "concurrently \"npm:format:*\" --names \"format:\"",
@@ -19,64 +21,69 @@
    "start": "ember serve",
    "test": "ember exam --test-port 0 --split=4 --parallel=1 --random",
    "test:ember-compatibility": "ember try:each",
-    "precommit": "yarn lint && yarn format && yarn test",
+    "precommit": "pnpm lint && pnpm format && pnpm test",
    "doc:toc": "doctoc README.md"
  },
  "dependencies": {
+    "@babel/core": "^7.26.10",
+    "@ember/string": "^4.0.0",
    "dexie": "^3.2.4",
-    "ember-auto-import": "^2.6.3",
+    "ember-auto-import": "^2.10.0",
    "ember-can": "^4.2.0",
-    "ember-cli-babel": "^7.26.10",
-    "ember-cli-htmlbars": "^6.2.0",
-    "ember-cli-mirage": "^2.4.0",
-    "ember-data": "~4.12.0",
-    "ember-fetch": "^8.1.1",
+    "ember-cli-babel": "^8.2.0",
+    "ember-cli-htmlbars": "^6.3.0",
+    "ember-cli-mirage": "^3.0.3",
+    "ember-data": "~5.3.12",
+    "miragejs": "^0.1.48",
    "tracked-built-ins": "^3.1.1"
  },
  "devDependencies": {
-    "@babel/core": "^7.21.0",
-    "@babel/eslint-parser": "^7.21.3",
-    "@babel/plugin-proposal-decorators": "^7.21.0",
-    "@ember/optional-features": "^2.0.0",
-    "@ember/string": "^3.0.1",
-    "@ember/test-helpers": "^2.9.3",
-    "@embroider/test-setup": "^2.1.1",
+    "@babel/eslint-parser": "^7.25.1",
+    "@babel/plugin-proposal-decorators": "^7.24.7",
+    "@ember/optional-features": "^2.1.0",
+    "@ember/test-helpers": "^5.2.1",
+    "@ember/test-waiters": "^4.1.0",
+    "@embroider/test-setup": "^4.0.0",
+    "@faker-js/faker": "^8.0.2",
    "@glimmer/component": "^1.1.2",
    "@glimmer/tracking": "^1.1.2",
    "broccoli-asset-rev": "^3.0.0",
-    "concurrently": "^8.0.1",
+    "concurrently": "^9.1.0",
    "doctoc": "^2.2.0",
-    "ember-cli": "^4.12.1",
-    "ember-cli-dependency-checker": "^3.3.1",
+    "ember-cli": "~5.12.0",
+    "ember-cli-clean-css": "^3.0.0",
+    "ember-cli-dependency-checker": "^3.3.2",
    "ember-cli-inject-live-reload": "^2.1.0",
    "ember-cli-sri": "^2.1.1",
    "ember-cli-terser": "^4.0.2",
    "ember-exam": "^8.0.0",
    "ember-load-initializers": "^2.1.2",
-    "ember-page-title": "^7.0.0",
-    "ember-qunit": "^6.2.0",
-    "ember-resolver": "^10.0.0",
-    "ember-source": "~4.12.0",
+    "ember-page-title": "^8.2.3",
+    "ember-qunit": "^8.1.0",
+    "ember-resolver": "^12.0.1",
+    "ember-source": "~5.12.0",
    "ember-source-channel-url": "^3.0.0",
-    "ember-template-lint": "^5.7.2",
-    "eslint": "^8.54.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-ember": "^11.11.1",
-    "eslint-plugin-n": "^16.3.1",
-    "eslint-plugin-qunit": "^8.0.1",
-    "@faker-js/faker": "^8.0.2",
+    "ember-template-lint": "^6.0.0",
+    "ember-try": "^3.0.0",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-ember": "^12.2.1",
+    "eslint-plugin-n": "^16.6.2",
+    "eslint-plugin-qunit": "^8.1.2",
    "js-bexpr": "hashicorp/js-bexpr#9b4a4b54d85eba67fdfc0990133d1518d890b1e1",
    "loader.js": "^4.7.0",
-    "prettier": "^3.0.0",
-    "qunit": "^2.19.4",
-    "qunit-dom": "^2.0.0",
-    "webpack": "^5.78.0"
+    "prettier": "^3.3.3",
+    "qunit": "^2.22.0",
+    "qunit-dom": "^3.2.1",
+    "sinon": "^19.0.2",
+    "webpack": "^5.95.0"
  },
  "peerDependencies": {
-    "ember-source": ">4.0.0"
+    "ember-source": ">= 4.0.0",
+    "sinon": "^19.0.2"
  },
  "engines": {
-    "node": "18.* || 20.*"
+    "node": "20.* || 22.*"
  },
  "ember": {
    "edition": "octane"
@@ -85,8 +92,11 @@
    "configPath": "tests/dummy/config"
  },
  "lint-staged": {
-    "*.js": "eslint --fix",
+    "*.js": [
+      "eslint --fix",
+      "prettier --write"
+    ],
    "*.hbs": "ember-template-lint --fix",
-    "*.{js,scss,yaml}": "prettier --write"
+    "*.{scss,yaml}": "prettier --write"
  }
 }
@@ -17,6 +17,12 @@ module.exports = {
        // --no-sandbox is needed when running Chrome inside a container
        process.env.CI ? '--no-sandbox' : null,
        '--headless',
+        // Disable backgrounding renders for occluded windows
+        '--disable-backgrounding-occluded-windows',
+        // Disable renderer process backgrounding
+        '--disable-renderer-backgrounding',
+        // Disable task throttling of timer tasks from background pages
+        '--disable-background-timer-throttling',
        '--disable-dev-shm-usage',
        '--disable-gpu',
        //'--disable-software-rasterizer',
@@ -4,7 +4,7 @@
 */

 import Route from '@ember/routing/route';
-import { inject as service } from '@ember/service';
+import { service } from '@ember/service';

 export default class ApplicationRoute extends Route {
  // =services
@@ -2,4 +2,3 @@
 * Copyright (c) HashiCorp, Inc.
 * SPDX-License-Identifier: BUSL-1.1
 */
-
@@ -5,6 +5,6 @@

 {{page-title "Dummy"}}

-<h2 id="title">Welcome to Ember</h2>
+<Hds::Text::Display @tag="h2" id="title">Welcome to Ember</Hds::Text::Display>

 {{outlet}}
@@ -3,7 +3,7 @@
  "packages": [
    {
      "name": "ember-cli",
-      "version": "4.12.1",
+      "version": "5.12.0",
      "blueprints": [
        {
          "name": "addon",
@@ -11,7 +11,8 @@
          "codemodsSource": "ember-addon-codemods-manifest@1",
          "isBaseBlueprint": true,
          "options": [
-            "--no-welcome"
+            "--no-welcome",
+            "--pnpm"
          ]
        }
      ]
@@ -10,28 +10,21 @@ const { embroiderSafe, embroiderOptimized } = require('@embroider/test-setup');

 module.exports = async function () {
  return {
+    usePnpm: true,
    scenarios: [
      {
-        name: 'ember-lts-4.4',
+        name: 'ember-lts-4.12',
        npm: {
          devDependencies: {
-            'ember-source': '~4.4.0',
+            'ember-source': '~4.12.0',
          },
        },
      },
      {
-        name: 'ember-lts-4.8',
+        name: 'ember-lts-5.4',
        npm: {
          devDependencies: {
-            'ember-source': '~4.8.0',
-          },
-        },
-      },
-      {
-        name: 'ember-lts-4.4',
-        npm: {
-          devDependencies: {
-            'ember-source': '~4.4.0',
+            'ember-source': '~5.4.0',
          },
        },
      },